AZ-500 Question 106
Select 2Your company runs a global news platform hosted in Azure Blob Storage for static images and documents. You plan to use Azure Front Door as a global entry point and want to integrate an Azure Content Delivery Network (CDN) to accelerate static content delivery. Each region uses a custom subdomain (e.g., images.contoso.com) that must be served over HTTPS for security. Which two steps should you take to implement this global deployment securely and ensure minimal latency for static content?
- A
Enable caching in Azure Front Door for all traffic and skip provisioning a dedicated CDN endpoint.
- B
Create a dedicated Azure CDN endpoint for the Blob Storage account and map images.contoso.com to the CDN with a managed certificate for HTTPS.
- C
Place the origin behind an Azure Load Balancer and allow only HTTP traffic so that any CDN request must use TLS.
- D
Add a new routing rule in Azure Front Door to match images.contoso.com and forward requests to the CDN endpoint as the backend.
- E
Manually upload a third-party SSL certificate to the Azure Blob Storage account for images.contoso.com.
Show answer and explanation
Correct answers: B, D
Explanation
By combining Azure Front Door for global entry and routing with Azure CDN for optimized static content caching, you ensure the best performance for end users while maintaining secure HTTPS connections. Front Door handles global traffic routing and can match domain requests (images.contoso.com) to the CDN endpoint. The CDN, in turn, serves static content from edge nodes around the world. For more details, see Microsoft documentation on integrating Azure Front Door with Azure CDN (https://learn.microsoft.com/azure/frontdoor).
- A. Incorrect.
Option 1: Incorrect. While Azure Front Door provides global load balancing and basic caching, relying on Front Door caching alone for large or frequently accessed content adds overhead and may not be as performant as a dedicated CDN. Also, skipping a dedicated CDN endpoint will forgo the benefits of specialized global edge nodes optimized for static content delivery.
- B. Correct.
Option 2: Correct. Creating a CDN endpoint mapped to your Blob Storage and adding a custom domain with a managed certificate ensures that static content is served from nearby edge locations over HTTPS. This is the recommended approach for reducing latency at scale.
- C. Incorrect.
Option 3: Incorrect. Placing the origin behind an Azure Load Balancer with only HTTP allowed does not force TLS at the CDN or Front Door level. Instead, you typically want the CDN or Front Door to handle TLS termination securely, not rely on an internal load balancer setup that only accepts HTTP.
- D. Correct.
Option 4: Correct. Configuring a custom routing rule in Azure Front Door that specifically points traffic for images.contoso.com to your CDN endpoint as the backend ensures that requests are routed to the nearest CDN edge for optimal delivery.
- E. Incorrect.
Option 5: Incorrect. Blob Storage does not allow you to attach custom SSL certificates directly in this manner for a subdomain of your own domain. The proper approach is to handle custom SSL certificates in Azure Front Door or the CDN, not within Blob Storage itself.