AZ-305 Question 240
Select 2A global e-commerce company hosts its web application on Azure in two regions: East US and West Europe. They require a single global endpoint with automatic routing to the nearest region, SSL termination, and application-layer protection for common web vulnerabilities. If one region fails, traffic should automatically fail over to the other without manual intervention. Which TWO of the following solutions can meet these requirements?
- A
Use Azure Front Door with a Web Application Firewall (WAF) policy to route requests globally and provide end-to-end SSL termination.
- B
Deploy a Public Azure Load Balancer in East US and configure it with health probes to direct traffic to West Europe if East US is not healthy.
- C
Use Azure Traffic Manager with performance-based routing in combination with Azure Application Gateway in each region for SSL offload and WAF protection.
- D
Deploy a single Azure Application Gateway in East US to handle all inbound traffic and rely on DNS failover to the West Europe region if the East US instance becomes unavailable.
Show answer and explanation
Correct answers: A, C
Explanation
Both Azure Front Door and the combination of Azure Traffic Manager with Application Gateways can distribute traffic globally while providing SSL termination, web attack protection, and high availability. Azure Front Door provides global layer 7 load balancing and WAF in a single service, while Traffic Manager plus Application Gateway uses DNS-based routing to direct clients to the nearest region and offers robust layer 7 inspection via Application Gateway’s WAF. For reference, see: https://learn.microsoft.com/azure/frontdoor/front-door-overview and https://learn.microsoft.com/azure/traffic-manager/traffic-manager-overview.
- A. Correct.
Option 1 is correct. Azure Front Door can distribute traffic globally based on latency, includes integrated WAF capabilities, and terminates SSL at the edge. This meets the need for global routing, failover, and application-layer protection.
- B. Incorrect.
Option 2 is incorrect. A Public Azure Load Balancer provides layer 4 load balancing, which does not offer application-layer inspection or global distribution. You would also need more than a single regional load balancer to handle a global endpoint scenario.
- C. Correct.
Option 3 is correct. Azure Traffic Manager with performance-based routing provides DNS-level global distribution. Combined with Azure Application Gateway in each region for SSL termination and WAF functionality, it fulfills the requirement for application-layer protection and automatic failover among regions.
- D. Incorrect.
Option 4 is incorrect. An Azure Application Gateway is regional. A single gateway in East US does not natively provide global routing or transparent failover for the West Europe region without additional services. Relying solely on DNS to fail over may introduce longer recovery times and does not meet the requirement for active-active global distribution.