Examkin

Question

Difficulty: MediumDesign Traffic Routing and Failover Strategies

A health-tech company is designing a disaster recovery and traffic routing solution for a global patient portal hosted in both the East US 2 and UK South regions. The design must meet the following requirements:
- Terminate SSL sessions at the global entry point.
- Inspect traffic using a Web Application Firewall (WAF).
- Route requests dynamically based on the URL path, directing `/clinical/*` to one set of backend services and `/billing/*` to another.
- Ensure failover to the secondary region occurs in under 30 seconds during an outage, without relying on client-side DNS caching updates.

Which Azure service or feature should you recommend to manage the ingress traffic routing?

  1. A
    Azure Traffic Manager
  2. Azure Front DoorAnswer
  3. C
    Azure SQL Database Auto-Failover Groups
  4. D
    Azure Traffic Manager routing to regional Standard Load Balancers configured with Basic SKU public IP addresses

Answer

Azure Front Door
The correct answer is Azure Front Door. Azure Front Door is a global Layer 7 load balancer that uses Anycast-based routing. It natively supports SSL offloading, WAF policy integration, and path-based routing. Because it splits TCP sessions close to users and uses Anycast, failover to a healthy region is extremely fast (under 30 seconds) and does not rely on client DNS cache expiration to route traffic away from an unhealthy region.

Step-by-Step Solution

1
Analyze the Layer 7 requirements of the portal.
The solution requires path-based routing, SSL termination, and WAF inspection. These are Application Layer (Layer 7) requirements.
This rules out DNS-based or Layer 4 network solutions that cannot inspect HTTP paths or perform SSL termination.
2
Analyze the failover time and DNS caching constraints.
Failover must happen in under 30 seconds without relying on client-side DNS updates. This indicates that an Anycast-based routing mechanism is needed instead of DNS-based routing.
DNS-based failover is dependent on client-side DNS caching and TTL, which often delays redirection beyond 30 seconds.
3
Evaluate SKU compatibility and scope of remaining options.
Mixing Standard Load Balancer with Basic SKU public IPs is invalid and will fail validation, and database failover groups are not web traffic routing services.
This confirms that Azure Front Door is the only valid, supported service that meets all architectural criteria.

Key Concept

Design Traffic Routing and Failover Strategies
Rate this question

Topics

Design Traffic Routing and Failover Strategies

More questions from this topic