Examkin

Question

Difficulty: HardApplication Load Balancing and Delivery

A fintech platform is designing the networking architecture for a single-region deployment in West US 3. The design must accommodate two distinct workloads:

1. An administrative web portal that requires SSL/TLS termination and URL path-based routing (routing `/api/*` to an API service and `/reports/*` to a reporting service).
2. A high-frequency transaction ingestion service that communicates over a custom TCP protocol on port 9000 and requires extremely low latency.

To ensure resilience, all entry-point load balancers must utilize zone-redundant public IP addresses. The virtual machines hosting the transaction ingestion service currently have Basic SKU public IP addresses assigned to their network interfaces.

Which two actions should you include in the network design to meet these requirements while preventing deployment validation errors?

  1. Deploy Azure Application Gateway (Standard v2 SKU) to manage the web portal's path-based routing and SSL/TLS termination.Answer
  2. Upgrade the public IP addresses of the transaction ingestion VMs to Standard SKU, and place the VMs behind an Azure Standard Load Balancer.Answer
  3. C
    Associate the transaction ingestion VMs directly with the backend pool of an Azure Standard Load Balancer while keeping their existing Basic SKU public IP addresses.
  4. D
    Configure an Azure Traffic Manager profile to manage SSL/TLS termination and path-based routing for the web portal.
  5. E
    Use Azure Front Door to load balance both the web portal's HTTP/HTTPS traffic and the ingestion service's custom TCP port 9000 traffic.

Answer

Deploy Azure Application Gateway (Standard v2 SKU) for the web portal's path-based routing and SSL/TLS termination, and upgrade the transaction ingestion VMs' public IPs to Standard SKU before placing them behind an Azure Standard Load Balancer.
To satisfy the web portal requirements, Azure Application Gateway (Standard v2) is selected because it is a regional Layer 7 load balancer that supports SSL/TLS termination, URL path-based routing, and zone redundancy. To satisfy the ingestion service requirements, Azure Standard Load Balancer is selected because it is a regional Layer 4 load balancer that supports custom TCP traffic, low latency, and zone redundancy. Because the ingestion VMs have Basic SKU public IPs, they must be upgraded to Standard SKU public IPs to avoid validation errors, as Standard Load Balancer backend pools do not support Basic SKU resources.

Step-by-Step Solution

1
Analyze the requirements for the web portal workload.
The web portal requires SSL/TLS termination and Layer 7 URL-based routing (`/api/*` and `/reports/*`) in a single region (West US 3) with zone redundancy. Azure Application Gateway (Standard v2 SKU) satisfies all of these criteria.
Application Gateway is a regional Layer 7 load balancer that supports path-based routing, SSL termination, and zone-redundant public IP addresses.
2
Analyze the requirements for the transaction ingestion workload.
The ingestion service requires low-latency Layer 4 load balancing for custom TCP traffic on port 9000 in a single region with zone redundancy. Azure Standard Load Balancer satisfies these needs.
Standard Load Balancer operates at Layer 4, handles any TCP/UDP port with ultra-low latency, and supports zone redundancy.
3
Identify the resource compatibility constraints to prevent validation errors.
The backend VMs currently have Basic SKU public IPs. Placing them behind a Standard Load Balancer causes a validation error due to SKU mismatch. The public IPs must be upgraded to Standard SKU first.
Azure does not allow mixing Basic SKU and Standard SKU resources within the same load balancer configuration.

Key Concept

Designing a hybrid Layer 4 and Layer 7 load balancing architecture while adhering to SKU compatibility requirements and protocol constraints.
Rate this question

Topics

Application Load Balancing and Delivery

More questions from this topic