AZ-700 Question 172
Select 2Your organization is designing a multi-tier web application in Azure. The front-end web tier must be publicly accessible over the internet, while the back-end microservices tier should only be accessible within the virtual network. You want to distribute traffic evenly to the front-end servers and provide internal load distribution for the back-end tier without exposing it to the internet. Which two design decisions should you implement to meet these requirements?
- A
Deploy a Public Azure Load Balancer for the front-end scale set.
- B
Deploy an Internal Azure Load Balancer for the back-end microservices.
- C
Expose the back-end microservices using a single Public Azure Load Balancer with a separate front-end IP configuration.
- D
Assign a public IP address to each back-end VM for direct internet access.
- E
Deploy only an Internal Azure Load Balancer for both tiers and rely on public NAT from on-premises.
Show answer and explanation
Correct answers: A, B
Explanation
A common multi-tier Azure design pattern uses a Public Azure Load Balancer to handle incoming internet traffic for the front-end tier and an Internal Azure Load Balancer to distribute traffic among back-end VMs that should not be accessible from the internet. According to Microsoft documentation on load balancing in Azure, public load balancers serve traffic from the internet, while internal load balancers handle traffic within a private virtual network.
- A. Correct.
Option 1 is correct. Using a Public Azure Load Balancer for the front-end scale set allows incoming internet traffic to be distributed among the front-end VMs while providing a public IP entry point.
- B. Correct.
Option 2 is correct. Deploying an Internal Azure Load Balancer for the back-end microservices restricts traffic to internal resources only, preventing direct internet access to those systems.
- C. Incorrect.
Option 3 is incorrect. Although you can create multiple front-end IP configurations on a Public Load Balancer, exposing the back-end microservices on a public endpoint defeats the requirement to keep them private.
- D. Incorrect.
Option 4 is incorrect. Assigning a public IP to each back-end VM bypasses any internal load balancing mechanism and violates the security requirement of restricting the back-end to internal access only.
- E. Incorrect.
Option 5 is incorrect. An Internal Azure Load Balancer alone cannot accept direct internet traffic, and relying on on-premises NAT would not meet the need for a scalable, Azure-based public entry point.