AZ-104 Question 239
Single answerYour company is deploying a multi-tier web application in Azure. The front-end needs to be publicly accessible for customer traffic, and the mid-tier services should only be reachable by internal requests within the virtual network. You need to ensure fault tolerance and load distribution for both tiers. Which configuration should you implement?
- A
Create two separate Azure Load Balancers: a public load balancer for the front-end and an internal load balancer for the mid-tier
- B
Configure a single public load balancer with inbound NAT rules for both the front-end and mid-tier VMs
- C
Use Azure Application Gateway to handle internet traffic and place the mid-tier VMs directly behind it without an internal load balancer
- D
Deploy an internal load balancer for the front-end and rely on Azure Traffic Manager for external traffic
Show answer and explanation
Correct answer: A
Explanation
A multi-tier application typically requires a public load balancer for externally accessible services and an internal load balancer for services that should only be reachable within the virtual network. This meets both high availability requirements and security boundaries for the front-end and mid-tier.
- A. Correct.
This correctly separates internet-facing traffic and internal-only traffic using a public load balancer for the front-end and an internal load balancer for the mid-tier
- B. Incorrect.
Using a single public load balancer with NAT rules for internal tiers is less secure and does not properly isolate the mid-tier from internet access
- C. Incorrect.
Azure Application Gateway is typically used for Layer 7 routing and endpoint security, but it doesn't replace the need for an internal load balancer for the mid-tier
- D. Incorrect.
An internal load balancer for the front-end would not allow public internet traffic, and Azure Traffic Manager is a DNS-based global traffic distribution solution rather than a direct load balancer for VMs in a single region