Examkin

Question

Difficulty: MediumApplication Load Balancing and Delivery

A financial services startup is modernizing a regional mobile banking API hosting solution in the North Europe region. The API is hosted on a pool of Azure Virtual Machines deployed within a private subnet of a virtual network.

The solution must satisfy the following technical requirements:
- Distribute incoming HTTPS traffic based on the URL path (e.g., routing `/accounts/*` and `/transfers/*` to different backend pools).
- Perform SSL/TLS termination at the load balancer level to offload decryption overhead from the virtual machines.
- Ensure the backend virtual machines remain isolated from the public internet by using only private IP addresses for backend pool communication.
- Prevent any validation or connectivity issues related to the virtual machines, which currently have Basic SKU Public IP addresses associated with their network interfaces for administrative troubleshooting.

Which load balancing solution should you design?

  1. A
    Deploy an Azure Standard Load Balancer in the virtual network.
  2. Deploy an Azure Application Gateway in the virtual network.Answer
  3. C
    Deploy an Azure Traffic Manager profile.
  4. D
    Deploy an Azure Basic Load Balancer in the virtual network.

Answer

Deploy an Azure Application Gateway in the virtual network.
The correct design is to deploy an Azure Application Gateway. As a regional Layer 7 load balancer, it supports the required HTTP/HTTPS routing features, including URL path-based routing and SSL/TLS termination. Because the Application Gateway communicates with the backend virtual machines using their private IP addresses inside the virtual network, the existing Basic SKU Public IP addresses on the virtual machines' network interfaces do not cause any compatibility or SKU validation errors.

Step-by-Step Solution

1
Identify the application layer requirements.
The requirements demand URL path-based routing and SSL/TLS termination, which are Layer 7 (application layer) capabilities.
Layer 4 load balancers (TCP/UDP) cannot inspect the HTTP/HTTPS request headers or paths to perform routing or decryption.
2
Evaluate regional vs global load balancing options.
The solution is regional (North Europe) and requires backend isolation within a private subnet.
Global load balancers like Azure Front Door or Traffic Manager are optimized for multi-region entry points and typically require public backend endpoints unless integrated with complex private services.
3
Analyze backend virtual machine SKU compatibility.
The virtual machines have Basic SKU Public IPs. Using an Application Gateway routes traffic using private IPs and avoids SKU mismatch conflicts.
Standard Load Balancers fail validation when combined with Basic SKU resources. Application Gateway integrates using internal private IPs, bypassing public IP SKU restrictions.

Key Concept

Selecting Azure load balancing services based on Layer 7 requirements (SSL termination, path-based routing) and backend SKU compatibility.
Estimated Time:1m 30s
Rate this question

Topics

Application Load Balancing and Delivery

More questions from this topic