Examkin

Question

Difficulty: HardDesign Traffic Routing and Failover Strategies

An enterprise is designing a multi-region disaster recovery and traffic routing architecture for several distinct workloads. Match each traffic routing and failover requirement to the most appropriate Azure service.

  • Route HTTPS traffic globally, enforce web application firewall (WAF) policies at the edge, offload SSL certificates, and failover within seconds without waiting for DNS client caching to expire.Azure Front Door
  • Route custom TCP/UDP traffic globally to regional endpoints using a single, static Anycast IP address, ensuring low-latency routing without DNS resolution overhead.Azure Cross-Region Load Balancer
  • Route TCP/UDP traffic globally using geographic or performance-based routing policies, where clients can tolerate failover times governed by DNS TTL values.Azure Traffic Manager
  • Route HTTP/HTTPS traffic regionally within a single Azure virtual network, providing private path-based routing, SSL termination, and cookie-based session affinity.Azure Application Gateway

Answer

The correct matches are: (1) Route HTTPS traffic globally with edge WAF, SSL offloading, and near-instant failover matches with Azure Front Door. (2) Route custom TCP/UDP traffic globally using a static Anycast IP without DNS overhead matches with Azure Cross-Region Load Balancer. (3) Route TCP/UDP traffic globally using DNS-based geographic/performance policies matches with Azure Traffic Manager. (4) Route HTTP/HTTPS traffic regionally within a single virtual network with SSL termination and session affinity matches with Azure Application Gateway.
Azure Front Door matches global Layer 7 requirements because it offers Anycast-based HTTP/HTTPS routing, SSL offloading, and edge WAF integration with near-instantaneous backend failover. Azure Cross-Region Load Balancer matches global Layer 4 requirements using a single static Anycast IP address to route TCP/UDP packets. Azure Traffic Manager provides DNS-based routing for any protocol globally, which depends on TTL for failover. Azure Application Gateway provides regional, private-network Layer 7 routing, cookie-based session affinity, and SSL termination.

Step-by-Step Solution

1
Analyze the operational scope (global vs. regional) and layers (Layer 4 vs. Layer 7) of the requirements.
Requirements 1 and 4 need Layer 7 features (WAF, SSL offloading, path routing). Requirements 2 and 3 need Layer 4 or general protocol routing. Requirement 4 is regional, whereas the others are global.
This categorizes the services: Azure Front Door and Application Gateway are Layer 7; Traffic Manager and Cross-Region Load Balancer operate at Layer 4 or DNS level. Application Gateway is regional.
2
Distinguish between the global Layer 7 solution and the regional Layer 7 solution.
The regional HTTP/HTTPS path routing and session affinity requirement maps to Azure Application Gateway. The global HTTPS requirement with WAF at the edge maps to Azure Front Door.
Azure Application Gateway cannot route traffic globally across regions natively, while Azure Front Door is designed for global edge delivery.
3
Differentiate between the global Layer 4 traffic routing mechanisms (Anycast IP routing vs. DNS-based routing).
The custom TCP/UDP workload requiring a single static Anycast IP maps to Azure Cross-Region Load Balancer. The TCP/UDP workload where DNS TTL-based failover is acceptable maps to Azure Traffic Manager.
Azure Cross-Region Load Balancer uses Anycast to route packets over the Microsoft backbone without DNS changes, while Azure Traffic Manager is purely DNS-based.

Key Concept

Selecting the optimal Azure load balancing and traffic routing service based on application scope (global vs. regional), protocol layer (Layer 4 vs. Layer 7), WAF/SSL requirements, and failover latency tolerance (DNS cache vs. Anycast routing).
Estimated Time:2m 30s
Rate this question

Topics

Design Traffic Routing and Failover Strategies

More questions from this topic