Examkin

Question

Difficulty: HardApplication Load Balancing and Delivery

An enterprise is modernizing a legacy web application in a single Azure region. The application requires routing incoming HTTP/HTTPS traffic to different virtual machine scale sets based on the URL path (such as routing `/api/*` to a dedicated API pool and `/web/*` to a web pool). The design must support SSL/TLS termination at the load balancing tier to offload decryption overhead from the backend instances. Additionally, administrative access to individual virtual machines must be preserved via Basic SKU Public IP addresses currently assigned directly to their network interfaces, and the load balancing solution must be restricted to regional distribution within the primary virtual network. Which of the following configuration options should the architect recommend?

  1. Deploy an Azure Application Gateway (Standard v2) and configure the backend pools to target the private IP addresses of the virtual machines.Answer
  2. B
    Deploy an Azure Standard Load Balancer and add the network interfaces of the virtual machines to the backend pool while retaining their Basic SKU Public IPs.
  3. C
    Deploy Azure Traffic Manager to distribute the incoming traffic and configure SSL termination and path-based routing rules.
  4. D
    Deploy Azure Front Door and configure routing rules to direct public HTTP/HTTPS requests to the Basic SKU Public IP addresses of the virtual machines.

Answer

Deploy an Azure Application Gateway (Standard v2) and configure the backend pools to target the private IP addresses of the virtual machines.
The correct option is the deployment of Azure Application Gateway (Standard v2) targeting the backend VMs' private IP addresses. Application Gateway is a regional Layer 7 load balancer that natively supports SSL/TLS termination and URL path-based routing. By configuring the backend pool to target the VMs' private IP addresses within the virtual network, the design remains regional and avoids SKU mismatch conflicts that occur when mixing Basic SKU public IPs with Standard SKU public load balancers.

Step-by-Step Solution

1
Analyze the load balancing protocol and routing requirements.
The requirements specify URL-based routing (`/api/*` and `/web/*`) and SSL/TLS termination, which necessitates a Layer 7 load balancing solution (Azure Application Gateway or Azure Front Door). Layer 4 options like Azure Load Balancer are eliminated.
URL path-based routing and SSL termination require inspection and termination of the HTTP/HTTPS sessions at the load balancer level.
2
Analyze the geographic and networking requirements.
The solution must be restricted to regional distribution within a single Azure region and integrated within the primary virtual network. This eliminates Azure Front Door, which is a global service.
Azure Application Gateway operates regionally within a virtual network subnet, satisfying the regional routing constraint.
3
Evaluate SKU compatibility and backend integration for the virtual machines.
The backend virtual machines utilize Basic SKU Public IPs on their NICs. Standard Load Balancer backend pools require Standard SKU IPs if public IPs are used, but Application Gateway can target the private IP addresses of the VMs within the VNet, avoiding any SKU validation errors.
Targeting private IPs prevents the mixing of Basic and Standard SKUs on the public-facing components of the load balancer architecture.

Key Concept

Azure Application Gateway provides regional Layer 7 load balancing, SSL offloading, and URL path-based routing while integrating with backends via private IP addresses to avoid SKU mismatch conflicts.
Rate this question

Topics

Application Load Balancing and Delivery

More questions from this topic