Examkin

Question

Difficulty: Very hardApplication Load Balancing and Delivery

A healthcare provider is deploying a multi-tier clinical application across two Azure regions: East US 2 and West US 2.

The architecture team specifies the following technical requirements for the application:
1. Global Traffic Ingress: Client traffic must be dynamically routed to the closest healthy region based on latency. The ingress layer must support SSL/TLS termination, URL path-based routing (routing `/api/*` traffic to API clusters and `/static/*` traffic to static assets), and Web Application Firewall (WAF) protection at the network edge.
2. Regional Backend Load Balancing: In each region, internal services communicating over TCP port 5005 must be load balanced across a backend pool of virtual machines. The load balancer must support High Availability (HA) ports.
3. Administrative Access: During a temporary transition phase, the backend virtual machines must maintain their existing direct administrative access using Basic SKU public IP addresses attached to their network interfaces.

You need to design a load balancing and delivery solution that satisfies all of the application's requirements while ensuring the deployment passes Azure validation.

Which two of the following components or configurations should you include in the design?

  1. Deploy Azure Front Door to manage global traffic routing, terminate SSL/TLS sessions, and enforce WAF policies at the edge.Answer
  2. Upgrade the public IP addresses of the backend virtual machine network interfaces (NICs) to the Standard SKU, and deploy a Standard SKU Azure Load Balancer for regional backend load balancing.Answer
  3. C
    Deploy Azure Traffic Manager to route global client traffic, terminate SSL/TLS sessions, and implement path-based routing rules.
  4. D
    Configure a Basic SKU Azure Load Balancer for the regional backend pools to support the high availability ports requirement without modifying the virtual machine public IP configurations.
  5. E
    Associate the virtual machines directly to a Standard SKU Azure Load Balancer backend pool while keeping their existing Basic SKU public IP addresses.

Answer

Deploy Azure Front Door to manage global traffic routing, terminate SSL/TLS sessions, and enforce WAF policies at the edge; and upgrade the public IP addresses of the backend virtual machine network interfaces (NICs) to the Standard SKU, and deploy a Standard SKU Azure Load Balancer for regional backend load balancing.
Deploying Azure Front Door satisfies the global ingress requirements because it is a global, layer-7 load balancer that supports latency-based routing, SSL/TLS termination, path-based routing, and WAF integration. Additionally, using a Standard SKU Azure Load Balancer is required to support High Availability (HA) ports for internal TCP traffic. Because Standard Load Balancers cannot have backend resources with Basic SKU public IP addresses, the existing Basic SKU public IPs on the virtual machine NICs must be upgraded to the Standard SKU to avoid validation failures.

Step-by-Step Solution

1
Evaluate global ingress requirements including SSL/TLS termination, path-based routing, latency-based routing, and WAF rules.
Determine that Azure Front Door is the correct global layer-7 delivery service, as Azure Traffic Manager only works at the DNS level and lacks these layer-7 application capabilities.
Selects the global service matching layer-7 routing and security requirements.
2
Evaluate regional load balancing requirements for TCP port 5005 with HA ports capability.
Determine that a Standard SKU Azure Load Balancer is required, as High Availability (HA) ports are not supported by the Basic SKU Azure Load Balancer.
Ensures the regional load balancer meets protocol and HA ports criteria.
3
Analyze backend virtual machine public IP requirements for validation compatibility.
Identify that the VMs have Basic SKU public IPs. Since a Standard Load Balancer requires all attached public IPs of backend resources to be of the Standard SKU, these IPs must be upgraded to Standard SKU.
Avoids validation failures caused by mixing Basic and Standard SKU resources in the load balancer backend pool.

Key Concept

Selecting and configuring Azure global and regional load balancing services based on layer-4 and layer-7 protocols, feature support (HA ports, SSL offloading, WAF), and resource SKU compatibility.
Rate this question

Topics

Application Load Balancing and Delivery

More questions from this topic