1"use strict";(globalThis.webpackChunkazurecertprep=globalThis.webpackChunkazurecertprep||[]).push([[3197],{30666(e,n,r){r.r(n),r.d(n,{assets:()=>c,contentTitle:()=>l,default:()=>h,frontMatter:()=>s,metadata:()=>a,toc:()=>d});const a=JSON.parse('{"id":"az-700/app-delivery/challenge-33","title":"Challenge 33: Multi-tier global load balancing","description":"90-120 minutes | ~$0.50/h combined (all load balancing services) | Exam weight: 15-20%","source":"@site/docs/az-700/03-app-delivery/challenge-33.md","sourceDirName":"az-700/03-app-delivery","slug":"/az-700/app-delivery/challenge-33","permalink":"/docs/az-700/app-delivery/challenge-33","draft":false,"unlisted":false,"editUrl":"https://github.com/azurecertprep/azurecertprep.github.io/tree/main/docs/az-700/03-app-delivery/challenge-33.md","tags":[],"version":"current","sidebarPosition":9,"frontMatter":{"sidebar_position":9,"title":"Challenge 33: Multi-tier global load balancing","sidebar_label":"Challenge 33"},"sidebar":"az700Sidebar","previous":{"title":"Challenge 32","permalink":"/docs/az-700/app-delivery/challenge-32"},"next":{"title":"Challenge 34","permalink":"/docs/az-700/private-access/challenge-34"}}');var t=r(74848),o=r(28453),i=r(67970);const s={sidebar_position:9,title:"Challenge 33: Multi-tier global load balancing",sidebar_label:"Challenge 33"},l="Challenge 33: Multi-tier global load balancing",c={},d=[{value:"Scenario",id:"scenario",level:2},{value:"Exam skills covered",id:"exam-skills-covered",level:2},{value:"Prerequisites",id:"prerequisites",level:2},{value:"The load balancing decision framework",id:"the-load-balancing-decision-framework",level:2},{value:"Decision matrix for Fabrikam",id:"decision-matrix-for-fabrikam",level:3},{value:"Task 1: Implement Azure Front Door for the global web tier",id:"task-1-implement-azure-front-door-for-the-global-web-tier",level:2},{value:"Azure CLI",id:"azure-cli",level:3},{value:"Azure PowerShell",id:"azure-powershell",level:3},{value:"Task 2: Implement Application Gateway for the regional API tier",id:"task-2-implement-application-gateway-for-the-regional-api-tier",level:2},{value:"Azure CLI",id:"azure-cli-1",level:3},{value:"Azure PowerShell",id:"azure-powershell-1",level:3},{value:"Task 4: Implement Traffic Manager for non-HTTP global failover",id:"task-4-implement-traffic-manager-for-non-http-global-failover",level:2},{value:"Azure CLI",id:"azure-cli-2",level:3},{value:"Azure PowerShell",id:"azure-powershell-2",level:3},{value:"Portal steps",id:"portal-steps",level:3},{value:"Task 5: Configure NSGs to allow Front Door health probes",id:"task-5-configure-nsgs-to-allow-front-door-health-probes",level:2},{value:"Azure CLI",id:"azure-cli-3",level:3},{value:"Azure PowerShell",id:"azure-powershell-3",level:3},{value:"Task 6: Verify end-to-end traffic flow",id:"task-6-verify-end-to-end-traffic-flow",level:2},{value:"Azure CLI",id:"azure-cli-4",level:3},{value:"Architecture summary",id:"architecture-summary",level:2},{value:"Break & fix",id:"break--fix",level:2},{value:"Scenario 1: Front Door health probes blocked by AppGW NSG",id:"scenario-1-front-door-health-probes-blocked-by-appgw-nsg",level:3},{value:"Scenario 2: Internal LB health probe failing (wrong probe port)",id:"scenario-2-internal-lb-health-probe-failing-wrong-probe-port",level:3},{value:"Scenario 3: Traffic Manager returning wrong endpoint",id:"scenario-3-traffic-manager-returning-wrong-endpoint",level:3},{value:"Knowledge check",id:"knowledge-check",level:2},{value:"Cleanup",id:"cleanup",level:2},{value:"Azure CLI",id:"azure-cli-5",level:3},{value:"Azure PowerShell",id:"azure-powershell-4",level:3}];function p(e){const n={admonition:"admonition",code:"code",del:"del",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,o.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.header,{children:(0,t.jsx)(n.h1,{id:"challenge-33-multi-tier-global-load-balancing",children:"Challenge 33: Multi-tier global load balancing"})}),"\n",(0,t.jsx)(n.admonition,{title:"Estimated time and cost",type:"info",children:(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"90-120 minutes"})," | ",(0,t.jsx)(n.strong,{children:"~$0.50/h combined"})," (all load balancing services) | ",(0,t.jsx)(n.strong,{children:"Exam weight: 15-20%"})]})}),"\n",(0,t.jsx)(n.h2,{id:"scenario",children:"Scenario"}),"\n",(0,t.jsx)(n.p,{children:"Fabrikam Corporation is migrating a three-tier application from on-premises to Azure. The architecture has:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Web tier"})," (public-facing): Global HTTP traffic serving users in North America, Europe, and Asia-Pacific. Requires content caching, SSL offload, and traffic acceleration."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"API tier"})," (regional): RESTful APIs behind path-based routing rules. Multiple microservices share a single entry point per region. Requires URL path routing, autoscaling backends, and WAF protection."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Data tier"}
1)," (internal): Database replicas and cache clusters accessible only from within the virtual network. Requires high-availability with L4 load balancing and no public exposure."]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Non-HTTP services"}),": SMTP relay and custom TCP services that need DNS-based global failover but do not use HTTP/HTTPS."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:"This is a design exercise that synthesizes all Domain 3 load balancing concepts into a single architecture. You will select the appropriate Azure load balancing service for each tier, implement the solution, and verify end-to-end traffic flow."}),"\n",(0,t.jsx)(n.h2,{id:"exam-skills-covered",children:"Exam skills covered"}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Skill"}),(0,t.jsx)(n.th,{children:"Weight"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Identify and recommend a load balancing solution (decision criteria)"}),(0,t.jsx)(n.td,{children:"High"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Combine multiple load balancing services in a multi-tier design"}),(0,t.jsx)(n.td,{children:"High"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Configure Azure Front Door for global HTTP acceleration"}),(0,t.jsx)(n.td,{children:"High"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Configure Application Gateway for regional L7 routing"}),(0,t.jsx)(n.td,{children:"High"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Configure Internal Load Balancer for private L4 balancing"}),(0,t.jsx)(n.td,{children:"High"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Configure Traffic Manager for non-HTTP global failover"}),(0,t.jsx)(n.td,{children:"Medium"})]})]})]}),"\n",(0,t.jsx)(n.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Azure subscription with Contributor role"}),"\n",(0,t.jsx)(n.li,{children:"Azure CLI 2.60+ or Azure PowerShell Az 12.0+"}),"\n",(0,t.jsx)(n.li,{children:"Completion of Challenges 25-32 (or equivalent knowledge of all LB services)"}),"\n",(0,t.jsx)(n.li,{children:"Understanding of hub-spoke network topology"}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"the-load-balancing-decision-framework",children:"The load balancing decision framework"}),"\n",(0,t.jsx)(n.p,{children:"Before implementing, you must select the correct service for each tier. Azure provides five load balancing services, each optimized for different scenarios."}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Criteria"}),(0,t.jsx)(n.th,{children:"Front Door"}),(0,t.jsx)(n.th,{children:"Traffic Manager"}),(0,t.jsx)(n.th,{children:"Application Gateway"}),(0,t.jsx)(n.th,{children:"Load Balancer"}),(0,t.jsx)(n.th,{children:"Gateway LB"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Scope"}),(0,t.jsx)(n.td,{children:"Global"}),(0,t.jsx)(n.td,{children:"Global"}),(0,t.jsx)(n.td,{children:"Regional"}),(0,t.jsx)(n.td,{children:"Regional"}),(0,t.jsx)(n.td,{children:"Regional"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Protocol"}),(0,t.jsx)(n.td,{children:"HTTP/HTTPS (L7)"}),(0,t.jsx)(n.td,{children:"DNS-based (any)"}),(0,t.jsx)(n.td,{children:"HTTP/HTTPS (L7)"}),(0,t.jsx)(n.td,{children:"TCP/UDP (L4)"}),(0,t.jsx)(n.td,{children:"TCP/UDP (L4)"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Deployment"}),(0,t.jsx)(n.td,{children:"Edge (anycast)"}),(0,t.jsx)(n.td,{children:"DNS only"}),(0,t.jsx)(n.td,{children:"In-VNet"}),(0,t.jsx)(n.td,{children:"In-VNet"}),(0,t.jsx)(n.td,{children:"Inline NVA"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Caching"}),(0,t.jsx)(n.td,{children:"Yes"}),(0,t.jsx)(n.td,{children:"No"}),(0,t.jsx)(n.td,{children:"No"}),(0,t.jsx)(n.td,{children:"No"}),(0,t.jsx)(n.td,{children:"No"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"WAF"}),(0,t.jsx)(n.td,{children:"Yes (Premium)"}),(0,t.jsx)(n.td,{children:"No"}),(0,t.jsx)(n.td,{children:"Yes"}),(0,t.jsx)(n.td,{children:"No"}),(0,t.jsx)(n.td,{children:"No"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Path routing"}),(0,t.jsx)(n.td,{children:"Via rules engine"}),(0,t.jsx)(n.td,{children:"No"}),(0,t.jsx)(n.td,{children:"Yes (native)"}),(0,t.jsx)(n.td,{children:"No"}),(0,t.jsx)(n.td,{children:"No"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Private backend"}),(0,t.jsx)(n.td,{children:"Premium PL"}),(0,t.jsx)(n.td,{children:"No"}),(0,t.jsx)(n.td,{children:"Yes (native)"}),(0,t.jsx)(n.td,{children:"Yes (native)"}),(0,t.jsx)(n.td,{children:"Yes"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"SSL offload"}),(0,t.jsx)(n.td,{children:"Yes"}),(0,t.jsx)(n.td,{children:"No"}),(0,t.jsx)(n.td,{children:"Yes"}),(0,t.jsx)(n.td,{children:"No"}),(0,t.jsx)(n.td,{children:"No"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Session affinity"}),(0,t.jsx)(n.td,{children:"Cookie-based"}),(0,t.jsx)(n.td,{children:"No"}),(0,t.jsx)(n.td,{children:"Cookie-based"}),(0,t.jsx)(n.td,{children:"Tuple-based"}),(0,t.jsx)(n.td,{children:"N/A"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Health probes"}),(0,t.jsx)(n.td,{children:"HTTP/HTTPS"}),(0,t.jsx)(n.td,{children:"HTTP/HTTPS/TCP"}),(0,t.jsx)(n.td,{children:"HTTP/HTTPS"}),(0,t.jsx)(n.td,{children:"TCP/HTTP/HTTPS"}),(0,t.jsx)(n.td,{children:"TCP/HTTP/HTTPS"})]})]})]}),"\n",(0,t.jsx)(n.h3,{id:"decision-matrix-for-fabrikam",children:"Decision matrix for Fabrikam"}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Tier"}),(0,t.jsx)(n.th,{children:"Requirement"}),(0,t.jsx)(n.th,{children:"Selected service"}),(0,t.jsx)(n.th,{children:"Rationale"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Web (global HTTP)"}),(0,t.jsx)(n.td,{children:"Global HTTP acceleration, caching, edge WAF"}),(0,t.jsx)(n.td,{children:(0,t.jsx)(n.strong,{children:"Azure Front Door"})}),(0,t.jsx)(n.td,{children:"Only service that provides anycast-based global HTTP acceleration with edge c
1aching"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"API (regional L7)"}),(0,t.jsx)(n.td,{children:"Path-based routing, WAF, autoscaling"}),(0,t.jsx)(n.td,{children:(0,t.jsx)(n.strong,{children:"Application Gateway v2"})}),(0,t.jsx)(n.td,{children:"Native URL path routing, integrated WAF, and auto-scaling within a region"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Data (internal L4)"}),(0,t.jsx)(n.td,{children:"Private L4 HA, no public exposure"}),(0,t.jsx)(n.td,{children:(0,t.jsx)(n.strong,{children:"Internal Load Balancer"})}),(0,t.jsx)(n.td,{children:"L4 balancing within VNet; no public IP needed"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"Non-HTTP (global)"}),(0,t.jsx)(n.td,{children:"DNS failover for TCP/SMTP services"}),(0,t.jsx)(n.td,{children:(0,t.jsx)(n.strong,{children:"Traffic Manager"})}),(0,t.jsx)(n.td,{children:"DNS-based distribution works with any protocol; only global option for non-HTTP"})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:"NVA chaining"}),(0,t.jsx)(n.td,{children:"Transparent insertion of firewall appliances"}),(0,t.jsx)(n.td,{children:(0,t.jsx)(n.strong,{children:"Gateway Load Balancer"})}),(0,t.jsx)(n.td,{children:"Chains NVAs inline without modifying application traffic path"})]})]})]}),"\n",(0,t.jsx)(n.admonition,{title:"Exam decision shortcuts",type:"tip",children:(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Global + HTTP"})," = Front Door"]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Global + non-HTTP"})," = Traffic Manager"]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Regional + HTTP + path routing"})," = Application Gateway"]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Regional + TCP/UDP"})," = Load Balancer (public or internal)"]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.strong,{children:"Transparent NVA insertion"})," = Gateway Load Balancer"]}),"\n"]})}),"\n",(0,t.jsx)(n.h2,{id:"task-1-implement-azure-front-door-for-the-global-web-tier",children:"Task 1: Implement Azure Front Door for the global web tier"}),"\n",(0,t.jsx)(n.p,{children:"Front Door provides the global entry point, accelerating HTTP traffic to users worldwide and caching static content at edge locations."}),"\n",(0,t.jsx)(n.h3,{id:"azure-cli",children:"Azure CLI"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:'# Set variables\nRG="rg-fabrikam-multitier"\nLOCATION_PRIMARY="eastus2"\nLOCATION_SECONDARY="westeurope"\n\n# Create resource group\naz group create --name $RG --location $LOCATION_PRIMARY\n\n# Create Front Door Premium profile\naz afd profile create \\\n --resource-group $RG \\\n --profile-name fd-fabrikam-web \\\n --sku Premium_AzureFrontDoor\n\n# Create endpoint\naz afd endpoint create \\\n --resource-group $RG \\\n --profile-name fd-fabrikam-web \\\n --endpoint-name ep-fabrikam-global \\\n --enabled-state Enabled\n\n# Create origin group for web tier backends\naz afd origin-group create \\\n --resource-group $RG \\\n --profile-name fd-fabrikam-web \\\n --origin-group-name og-web-appgw \\\n --probe-request-type GET \\\n --probe-protocol Https \\\n --probe-interval-in-seconds 30 \\\n --probe-path "/health" \\\n --sample-size 4 \\\n --successful-samples-required 3 \\\n --additional-latency-in-milliseconds 50\n\n# Add Application Gateway in East US 2 as primary origin\naz afd origin create \\\n --resource-group $RG \\\n --profile-name fd-fabrikam-web \\\n --origin-group-name og-web-appgw \\\n --origin-name origin-appgw-eastus2 \\\n --host-name appgw-fabrikam-eastus2.eastus2.cloudapp.azure.com \\\n --origin-host-header appgw-fabrikam-eastus2.eastus2.cloudapp.azure.com \\\n --http-port 80 \\\n --https-port 443 \\\n --priority 1 \\\n --weight 1000 \\\n --enabled-state Enabled\n\n# Add Application Gateway in West Europe as secondary origin\naz afd origin create \\\n --resource-group $RG \\\n --profile-name fd-fabrikam-web \\\n --origin-group-name og-web-appgw \\\n --origin-name origin-appgw-westeurope \\\n --host-name appgw-fabrikam
1-westeurope.westeurope.cloudapp.azure.com \\\n --origin-host-header appgw-fabrikam-westeurope.westeurope.cloudapp.azure.com \\\n --http-port 80 \\\n --https-port 443 \\\n --priority 2 \\\n --weight 1000 \\\n --enabled-state Enabled\n\n# Create route with caching for static content\naz afd route create \\\n --resource-group $RG \\\n --profile-name fd-fabrikam-web \\\n --endpoint-name ep-fabrikam-global \\\n --route-name route-web \\\n --origin-group og-web-appgw \\\n --patterns-to-match "/*" \\\n --supported-protocols Http Https \\\n --https-redirect Enabled \\\n --forwarding-protocol HttpsOnly \\\n --link-to-default-domain Enabled \\\n --enable-caching true \\\n --enable-compression true \\\n --query-string-caching-behavior UseQueryString\n'})}),"\n",(0,t.jsx)(n.h3,{id:"azure-powershell",children:"Azure PowerShell"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-powershell",children:'# Set variables\n$rg = "rg-fabrikam-multitier"\n$locationPrimary = "eastus2"\n$locationSecondary = "westeurope"\n\n# Create resource group\nNew-AzResourceGroup -Name $rg -Location $locationPrimary\n\n# Create Front Door Premium\nNew-AzFrontDoorCdnProfile `\n -ResourceGroupName $rg `\n -ProfileName "fd-fabrikam-web" `\n -SkuName "Premium_AzureFrontDoor"\n\n# Create endpoint\nNew-AzFrontDoorCdnEndpoint `\n -ResourceGroupName $rg `\n -ProfileName "fd-fabrikam-web" `\n -EndpointName "ep-fabrikam-global" `\n -Location "Global" `\n -EnabledState "Enabled"\n'})}),"\n",(0,t.jsx)(n.h2,{id:"task-2-implement-application-gateway-for-the-regional-api-tier",children:"Task 2: Implement Application Gateway for the regional API tier"}),"\n",(0,t.jsx)(n.p,{children:"Application Gateway provides L7 load balancing within each region, with URL path-based routing to direct traffic to different microservice backends."}),"\n",(0,t.jsx)(n.h3,{id:"azure-cli-1",children:"Azure CLI"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:'# Create VNet and subnets for Application Gateway\naz network vnet create \\\n --resource-group $RG \\\n --name vnet-fabrikam-eastus2 \\\n --location $LOCATION_PRIMARY \\\n --address-prefixes 10.1.0.0/16 \\\n --subnet-name snet-appgw \\\n --subnet-prefixes 10.1.0.0/24\n\naz network vnet subnet create \\\n --resource-group $RG \\\n --vnet-name vnet-fabrikam-eastus2 \\\n --name snet-api \\\n --address-prefixes 10.1.1.0/24\n\naz network vnet subnet create \\\n --resource-group $RG \\\n --vnet-name vnet-fabrikam-eastus2 \\\n --name snet-data \\\n --address-prefixes 10.1.2.0/24\n\n# Create public IP for Application Gateway\naz network public-ip create \\\n --resource-group $RG \\\n --name pip-appgw-eastus2 \\\n --location $LOCATION_PRIMARY \\\n --sku Standard \\\n --allocation-method Static \\\n --zone 1 2 3\n\n# Create Application Gateway WAF v2 with path-based routing\naz network application-gateway create \\\n --resource-group $RG \\\n --name appgw-fabrikam-eastus2 \\\n --location $LOCATION_PRIMARY \\\n --sku WAF_v2 \\\n --capacity 2 \\\n --vnet-name vnet-fabrikam-eastus2 \\\n --subnet snet-appgw \\\n --public-ip-address pip-appgw-eastus2 \\\n --http-settings-port 443 \\\n --http-settings-protocol Https \\\n --frontend-port 443 \\\n --priority 100\n\n# Create backend pools for different microservices\naz network application-gateway address-pool create \\\n --resource-group $RG \\\n --gateway-name appgw-fabrikam-eastus2 \\\n --name pool-orders-api \\\n --servers 10.1.1.10 10.1.1.11\n\naz network application-gateway address-pool create \\\n --resource-group $RG \\\n --gateway-name appgw-fabrikam-eastus2 \\\n --name pool-inventory-api \\\n --servers 10.1.1.20 10.1.1.21\n\n# Create URL path map for routing\naz network application-gateway url-path-map create \\\n --resource-group $RG \\\n --gateway-name appgw-fabrikam-eastus2 \\\n --name pathmap-api \\\n --default-address-pool pool-orders-api \\\n --default-http-settings appGatewayBackendHttpSettings \\\n --paths "/api/orders/*" \\\n --address-pool pool-orders-api \\\n --http-settings appGatewayBackendHttpSettings \\\n --path-map-rule-name rule-orders\n\naz network application-gateway url-path-map rule create \\\n --resource-group $RG \\\n --gateway-name appgw-fabrikam
1-eastus2 \\\n --name rule-inventory \\\n --path-map-name pathmap-api \\\n --paths "/api/inventory/*" \\\n --address-pool pool-inventory-api \\\n --http-settings appGatewayBackendHttpSettings\n'})}),"\n",(0,t.jsx)(n.h3,{id:"azure-powershell-1",children:"Azure PowerShell"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-powershell",children:'# Create VNet\n$appgwSubnet = New-AzVirtualNetworkSubnetConfig -Name "snet-appgw" -AddressPrefix "10.1.0.0/24"\n$apiSubnet = New-AzVirtualNetworkSubnetConfig -Name "snet-api" -AddressPrefix "10.1.1.0/24"\n$dataSubnet = New-AzVirtualNetworkSubnetConfig -Name "snet-data" -AddressPrefix "10.1.2.0/24"\n\nNew-AzVirtualNetwork `\n -ResourceGroupName $rg `\n -Name "vnet-fabrikam-eastus2" `\n -Location $locationPrimary `\n -AddressPrefix "10.1.0.0/16" `\n -Subnet $appgwSubnet, $apiSubnet, $dataSubnet\n\n# Create public IP\n$pip = New-AzPublicIpAddress `\n -ResourceGroupName $rg `\n -Name "pip-appgw-eastus2" `\n -Location $locationPrimary `\n -Sku "Standard" `\n -AllocationMethod "Static" `\n -Zone 1, 2, 3\n\n# Application Gateway configuration (simplified for readability)\n$vnet = Get-AzVirtualNetwork -ResourceGroupName $rg -Name "vnet-fabrikam-eastus2"\n$subnet = Get-AzVirtualNetworkSubnetConfig -VirtualNetwork $vnet -Name "snet-appgw"\n\n$gipConfig = New-AzApplicationGatewayIPConfiguration -Name "appGwIPConfig" -Subnet $subnet\n$fipConfig = New-AzApplicationGatewayFrontendIPConfig -Name "appGwFrontendIP" -PublicIPAddress $pip\n$frontendPort = New-AzApplicationGatewayFrontendPort -Name "port443" -Port 443\n\n$poolOrders = New-AzApplicationGatewayBackendAddressPool -Name "pool-orders-api" `\n -BackendIPAddresses "10.1.1.10","10.1.1.11"\n$poolInventory = New-AzApplicationGatewayBackendAddressPool -Name "pool-inventory-api" `\n -BackendIPAddresses "10.1.1.20","10.1.1.21"\n\n\n\n### Azure PowerShell\n\n```powershell\n# Get subnet reference\n$vnet = Get-AzVirtualNetwork -ResourceGroupName $rg -Name "vnet-fabrikam-eastus2"\n$dataSubnet = Get-AzVirtualNetworkSubnetConfig -VirtualNetwork $vnet -Name "snet-data"\n\n# Create frontend IP configuration (internal)\n$feIpConfig = New-AzLoadBalancerFrontendIpConfig `\n -Name "fe-data" `\n -Subnet $dataSubnet `\n -PrivateIpAddress "10.1.2.10"\n\n# Create backend pool\n$bePool = New-AzLoadBalancerBackendAddressPoolConfig -Name "pool-sql-replicas"\n\n# Create health probe\n$probe = New-AzLoadBalancerProbeConfig `\n -Name "probe-sql" `\n -Protocol "Tcp" `\n -Port 1433 `\n -IntervalInSeconds 15 `\n -ProbeCount 2\n\n# Create load balancing rule\n$lbRule = New-AzLoadBalancerRuleConfig `\n -Name "rule-sql" `\n -FrontendIpConfiguration $feIpConfig `\n -BackendAddressPool $bePool `\n -Probe $probe `\n -Protocol "Tcp" `\n -FrontendPort 1433 `\n -BackendPort 1433 `\n -IdleTimeoutInMinutes 30 `\n -EnableTcpReset\n\n# Create the Internal Load Balancer\nNew-AzLoadBalancer `\n -ResourceGroupName $rg `\n -Name "ilb-fabrikam-data" `\n -Location $locationPrimary `\n -Sku "Standard" `\n -FrontendIpConfiguration $feIpConfig `\n -BackendAddressPool $bePool `\n -Probe $probe `\n -LoadBalancingRule $lbRule\n'})}),"\n",(0,t.jsx)(n.h2,{id:"task-4-implement-traffic-manager-for-non-http-global-failover",children:"Task 4: Implement Traffic Manager for non-HTTP global failover"}),"\n",(0,t.jsx)(n.p,{children:"Traffic Manager provides DNS-based global load balancing for the SMTP relay service that cannot use HTTP-based probing."}),"\n",(0,t.jsx)(n.h3,{id:"azure-cli-2",children:"Azure CLI"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:'# Create Traffic Manager profile with priority routing\naz network traffic-manager profile create \\\n --resource-group $RG \\\n --name tm-fabrikam-smtp \\\n --routing-method Priority \\\n --unique-dns-name fabrikam-smtp-relay \\\n --ttl 30 \\\n --protocol TCP \\\n --port 25 \\\n --interval 30 \\\n --timeout 10 \\\n --max-failures 3\n\n# Add primary endpoint (East US 2)\naz network traffic-manager endpoint create \\\n --resource-group $RG \\\n --profile-name tm-fabrikam
1-smtp \\\n --name ep-smtp-eastus2 \\\n --type externalEndpoints \\\n --target smtp-eastus2.fabrikam.com \\\n --endpoint-status Enabled \\\n --priority 1\n\n# Add secondary endpoint (West Europe)\naz network traffic-manager endpoint create \\\n --resource-group $RG \\\n --profile-name tm-fabrikam-smtp \\\n --name ep-smtp-westeurope \\\n --type externalEndpoints \\\n --target smtp-westeurope.fabrikam.com \\\n --endpoint-status Enabled \\\n --priority 2\n\n# Verify Traffic Manager DNS resolution\naz network traffic-manager profile show \\\n --resource-group $RG \\\n --name tm-fabrikam-smtp \\\n --query "{fqdn:dnsConfig.fqdn, routing:trafficRoutingMethod, monitorProtocol:monitorConfig.protocol}" \\\n --output table\n'})}),"\n",(0,t.jsx)(n.h3,{id:"azure-powershell-2",children:"Azure PowerShell"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-powershell",children:'# Create Traffic Manager profile\nNew-AzTrafficManagerProfile `\n -ResourceGroupName $rg `\n -Name "tm-fabrikam-smtp" `\n -TrafficRoutingMethod "Priority" `\n -RelativeDnsName "fabrikam-smtp-relay" `\n -Ttl 30 `\n -MonitorProtocol "TCP" `\n -MonitorPort 25 `\n -MonitorIntervalInSeconds 30 `\n -MonitorTimeoutInSeconds 10 `\n -MonitorToleratedNumberOfFailures 3\n\n# Add primary endpoint\nNew-AzTrafficManagerEndpoint `\n -ResourceGroupName $rg `\n -ProfileName "tm-fabrikam-smtp" `\n -Name "ep-smtp-eastus2" `\n -Type "ExternalEndpoints" `\n -Target "smtp-eastus2.fabrikam.com" `\n -EndpointStatus "Enabled" `\n -Priority 1\n\n# Add secondary endpoint\nNew-AzTrafficManagerEndpoint `\n -ResourceGroupName $rg `\n -ProfileName "tm-fabrikam-smtp" `\n -Name "ep-smtp-westeurope" `\n -Type "ExternalEndpoints" `\n -Target "smtp-westeurope.fabrikam.com" `\n -EndpointStatus "Enabled" `\n -Priority 2\n'})}),"\n",(0,t.jsx)(n.h3,{id:"portal-steps",children:"Portal steps"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["Navigate to ",(0,t.jsx)(n.strong,{children:"Traffic Manager profiles"})," > ",(0,t.jsx)(n.strong,{children:"Create"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Set Name to ",(0,t.jsx)(n.code,{children:"tm-fabrikam-smtp"}),", Routing method to ",(0,t.jsx)(n.strong,{children:"Priority"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["After creation, go to ",(0,t.jsx)(n.strong,{children:"Endpoints"})," > ",(0,t.jsx)(n.strong,{children:"Add"}),"."]}),"\n",(0,t.jsx)(n.li,{children:"Add external endpoints for each SMTP relay with appropriate priority values."}),"\n",(0,t.jsxs)(n.li,{children:["Under ",(0,t.jsx)(n.strong,{children:"Configuration"}),", set Monitor protocol to ",(0,t.jsx)(n.strong,{children:"TCP"}),", port to ",(0,t.jsx)(n.strong,{children:"25"}),"."]}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"task-5-configure-nsgs-to-allow-front-door-health-probes",children:"Task 5: Configure NSGs to allow Front Door health probes"}),"\n",(0,t.jsxs)(n.p,{children:["A critical integration point: Front Door health probes originate from the ",(0,t.jsx)(n.code,{children:"AzureFrontDoor.Backend"})," service tag. If Application Gateway NSGs block this traffic, probes fail and Front Door marks the origin as unhealthy."]}),"\n",(0,t.jsx)(n.h3,{id:"azure-cli-3",children:"Azure CLI"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:'# Create NSG for the Application Gateway subnet\naz network nsg create \\\n --resource-group $RG \\\n --name nsg-appgw-subnet \\\n --location $LOCATION_PRIMARY\n\n# Allow Front Door health probes (service tag)\naz network nsg rule create \\\n --resource-group $RG \\\n --nsg-name nsg-appgw-subnet \\\n --name AllowFrontDoorProbes \\\n --priority 100 \\\n --direction Inbound \\\n --access Allow \\\n --protocol Tcp \\\n --source-address-prefixes AzureFrontDoor.Backend \\\n --destination-port-ranges 443 80 \\\n --description "Allow Azure Front Door health probes"\n\n# Allow Application Gateway v2 infrastructure (required)\naz network nsg rule create \\\n --resource-group $RG \\\n --nsg-name nsg-appgw-subnet \\\n --name AllowGatewayManager \\\n --priority 110 \\\n --direction Inbound \\\n --access Allow \\\n --protocol Tcp \\\n --source-address-prefixes GatewayManager \\\n --destination-port-ranges 65200-65535 \\\n --description "Required for AppGW v2 infrastru
1cture"\n\n# Allow Azure Load Balancer probes (required for AppGW health)\naz network nsg rule create \\\n --resource-group $RG \\\n --nsg-name nsg-appgw-subnet \\\n --name AllowAzureLBProbes \\\n --priority 120 \\\n --direction Inbound \\\n --access Allow \\\n --protocol Tcp \\\n --source-address-prefixes AzureLoadBalancer \\\n --destination-port-ranges "*" \\\n --description "Allow Azure LB health probes"\n\n# Associate NSG with the Application Gateway subnet\naz network vnet subnet update \\\n --resource-group $RG \\\n --vnet-name vnet-fabrikam-eastus2 \\\n --name snet-appgw \\\n --network-security-group nsg-appgw-subnet\n'})}),"\n",(0,t.jsx)(n.h3,{id:"azure-powershell-3",children:"Azure PowerShell"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-powershell",children:'# Create NSG with Front Door rule\n$ruleFD = New-AzNetworkSecurityRuleConfig `\n -Name "AllowFrontDoorProbes" `\n -Priority 100 `\n -Direction "Inbound" `\n -Access "Allow" `\n -Protocol "Tcp" `\n -SourceAddressPrefix "AzureFrontDoor.Backend" `\n -SourcePortRange "*" `\n -DestinationAddressPrefix "*" `\n -DestinationPortRange "443","80"\n\n$ruleGwMgr = New-AzNetworkSecurityRuleConfig `\n -Name "AllowGatewayManager" `\n -Priority 110 `\n -Direction "Inbound" `\n -Access "Allow" `\n -Protocol "Tcp" `\n -SourceAddressPrefix "GatewayManager" `\n -SourcePortRange "*" `\n -DestinationAddressPrefix "*" `\n -DestinationPortRange "65200-65535"\n\n$nsg = New-AzNetworkSecurityGroup `\n -ResourceGroupName $rg `\n -Name "nsg-appgw-subnet" `\n -Location $locationPrimary `\n -SecurityRules $ruleFD, $ruleGwMgr\n\n# Associate with subnet\n$vnet = Get-AzVirtualNetwork -ResourceGroupName $rg -Name "vnet-fabrikam-eastus2"\n$subnet = Get-AzVirtualNetworkSubnetConfig -VirtualNetwork $vnet -Name "snet-appgw"\n$subnet.NetworkSecurityGroup = $nsg\nSet-AzVirtualNetwork -VirtualNetwork $vnet\n'})}),"\n",(0,t.jsx)(n.h2,{id:"task-6-verify-end-to-end-traffic-flow",children:"Task 6: Verify end-to-end traffic flow"}),"\n",(0,t.jsx)(n.p,{children:"Validate the architecture by checking each component's health and connectivity."}),"\n",(0,t.jsx)(n.h3,{id:"azure-cli-4",children:"Azure CLI"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:'# Check Front Door endpoint health\naz afd endpoint show \\\n --resource-group $RG \\\n --profile-name fd-fabrikam-web \\\n --endpoint-name ep-fabrikam-global \\\n --query "{hostname:hostName, state:enabledState}" \\\n --output table\n\n# Check origin health states\naz afd origin list \\\n --resource-group $RG \\\n --profile-name fd-fabrikam-web \\\n --origin-group-name og-web-appgw \\\n --query "[].{name:name, enabled:enabledState, priority:priority}" \\\n --output table\n\n# Check Application Gateway backend health\naz network application-gateway show-backend-health \\\n --resource-group $RG \\\n --name appgw-fabrikam-eastus2 \\\n --query "backendAddressPools[].backendHttpSettingsCollection[].servers[].{address:address, health:health}" \\\n --output table\n\n# Check Internal Load Balancer backend health\naz network lb show \\\n --resource-group $RG \\\n --name ilb-fabrikam-data \\\n --query "backendAddressPools[].{name:name, count:loadBalancerBackendAddresses|length(@)}" \\\n --output table\n\n# Check Traffic Manager endpoint status\naz network traffic-manager endpoint list \\\n --resource-group $RG \\\n --profile-name tm-fabrikam-smtp \\\n --type externalEndpoints \\\n --query "[].{name:name, status:endpointMonitorStatus, priority:priority}" \\\n --output table\n'})}),"\n",(0,t.jsx)(n.h2,{id:"architecture-summary",children:"Architecture summary"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-text",children:"Users (Global)\n |\n v\n[Azure Front Door Premium] <-- Global HTTP acceleration + caching + WAF\n |\n |--- East US 2 (Priority 1)\n | |\n | v\n | [Application Gateway v2] <-- Regional L7: path-based routing\n | |\n | |--- /api/orders/* --\x3e pool-orders-api (10.1.1.10, .11)\n | |--- /api/inventory/* --\x3e pool-inventory-api (10.1.1.20, .21)\n | |\n | v\n | [Internal Load Balancer] <-- L4 HA for data tier\n | |--- SQL: port 1433 --\x3e replicas\n | |--- Redis: port 6380 --\x3e cache nodes\n |\n |--- West Europe (Priority 2, failover)\n |\n v\n [Application Gateway v2] <-- Same pattern, secondary region\n |\n v\n [Internal Load Balancer]\n\n[Traffic Manager] <-- DNS failover for non-HTTP (SMTP)\n |--- smtp-eastus2.fabrikam.com (Priority 1)\n |--- smtp-westeurope.fabrikam.com (Priority 2)\n"})}),"\n",(0,t.jsx)(n.h2,{id:"break--fix",children:"Break & fix"}),"\n",(0,t.jsx)(n.h3,{id:"scenario-1-front-door-health-probes-blocked-by-appgw-nsg",children:"Scenario 1: Front Door health probes blocked by AppGW NSG"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"# Simulate: Remove the Front Door allow rule from the NSG\naz network nsg rule delete \\\n --resource-group $RG \\\n --nsg-name nsg-appgw-subnet \\\n --name AllowFrontDoorProbes\n"})}),"\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Symptom"}),": Front Door marks the Application Gateway origin as unhealthy. The endpoint returns 503 to all users, even though Application Gateway itself is working fine and directly accessible."]}),"\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Root cause"}),": Front Door health probes originate from the ",(0,t.jsx)(n.code,{children:"AzureFrontDoor.Backend"})," service tag IP ranges. Without an NSG rule allowing this traffic, probes are dropped at the subnet level and Front Door cannot verify backend health."]}),"\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Fix"}),": Re-add the NSG rule allowing Front Door probes:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"az network nsg rule create \\\n --resource-group $RG \\\n --nsg-name nsg-appgw-subnet \\\n --name AllowFrontDoorProbes \\\n --priority 100 \\\n --direction Inbound \\\n --access Allow \\\n --protocol Tcp \\\n --source-address-prefixes AzureFrontDoor.Backend \\\n --destination-port-ranges 443 80\n"})}),"\n",(0,t.jsx)(n.h3,{id:"scenario-2-internal-lb-health-probe-failing-wrong-probe-port",children:"Scenario 2
1: Internal LB health probe failing (wrong probe port)"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"# Misconfigure the SQL health probe to wrong port\naz network lb probe update \\\n --resource-group $RG \\\n --lb-name ilb-fabrikam-data \\\n --name probe-sql \\\n --port 1434\n"})}),"\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Symptom"}),": API tier receives connection timeouts when querying the database through the internal load balancer. The load balancer stops routing traffic to backend SQL instances."]}),"\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Root cause"}),": The health probe targets port 1434, but SQL Server listens on port 1433. All probe attempts fail, so the LB marks all backends as unhealthy and stops forwarding traffic."]}),"\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Fix"}),": Correct the probe port:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"az network lb probe update \\\n --resource-group $RG \\\n --lb-name ilb-fabrikam-data \\\n --name probe-sql \\\n --port 1433\n"})}),"\n",(0,t.jsx)(n.h3,{id:"scenario-3-traffic-manager-returning-wrong-endpoint",children:"Scenario 3: Traffic Manager returning wrong endpoint"}),"\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Symptom"}),": Non-HTTP traffic always routes to the secondary SMTP relay even when the primary is healthy."]}),"\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Diagnosis"}),":"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:'# Check endpoint monitoring status\naz network traffic-manager endpoint show \\\n --resource-group $RG \\\n --profile-name tm-fabrikam-smtp \\\n --name ep-smtp-eastus2 \\\n --type externalEndpoints \\\n --query "{name:name, status:endpointMonitorStatus, priority:priority}" \\\n --output json\n'})}),"\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Root cause"}),": The primary endpoint has ",(0,t.jsx)(n.code,{children:"endpointMonitorStatus: Degraded"})," because the health monitor is configured with the wrong port or the SMTP service is not listening."]}),"\n",(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.strong,{children:"Fix"}),": Verify the monitor configuration matches the service:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"az network traffic-manager profile update \\\n --resource-group $RG \\\n --name tm-fabrikam-smtp \\\n --protocol TCP \\\n --port 25\n"})}),"\n",(0,t.jsx)(n.h2,{id:"knowledge-check",children:"Knowledge check"}),"\n",(0,t.jsx)(i.A,{questions:[{id:"az700-33-q1",question:"Fabrikam needs global load balancing for a TCP-based service on port 5672 (AMQP). Which Azure service should they use?",options:["Traffic Manager with TCP health probes \u2705","Azure Front Door with TCP forwarding","Application Gateway with TCP listeners","Azure Load Balancer with global tier"],correctIndex:0,explanation:"Traffic Manager is the only Azure global load balancing service that works with non-HTTP protocols. It operates at the DNS layer and uses TCP/HTTP/HTTPS health probes. Front Door only handles HTTP/HTTPS. Application Gateway and Load Balancer are regional services."},{id:"az700-33-q2",question:"In a multi-tier architecture, Front Door routes traffic to Application Gateway. Front Door probes show the AppGW origin as unhealthy, but AppGW responds correctly to direct browser requests. What is the most likely cause?",options:["An NSG on the Application Gateway subnet blocks the AzureFrontDoor.Backend service tag \u2705","Application Gateway WAF is blocking the probes","Front Door and Application Gateway are in different subscriptions","The Application Gateway health probe path returns a redirect"],correctIndex:0,explanation:"Front Door health probes originate from the AzureFrontDoor.Backend service tag IP ranges. If an NSG on the AppGW subnet does not have an allow rule for this service tag, probes are silently dropped. Direct browser access works because it comes from a different IP range."},{id:"az700-33-q3",question:"Which combination correctly matches each service to its load balancing layer?",options:["Front Door = Global L7, Traffic Manager = Global DNS, Application Gateway = Regional L7, Load Balancer = Regional L4 \u2705","Front Door = Regional L7, Traffic Manager = Global L7, Application Gateway = Global DNS, Lo
1ad Balancer = Regional L4","Front Door = Global L4, Traffic Manager = Global DNS, Application Gateway = Regional L7, Load Balancer = Regional L7","Front Door = Global L7, Traffic Manager = Regional DNS, Application Gateway = Regional L4, Load Balancer = Regional L4"],correctIndex:0,explanation:"Front Door operates at L7 globally (HTTP/HTTPS with anycast). Traffic Manager is DNS-based global distribution (works with any protocol). Application Gateway is a regional L7 load balancer (HTTP/HTTPS with path routing). Load Balancer is a regional L4 service (TCP/UDP)."},{id:"az700-33-q4",question:"An Internal Load Balancer health probe is configured on port 1434, but the SQL Server backend listens on port 1433. What happens?",options:["All backends are marked unhealthy and the LB stops forwarding traffic on port 1433 \u2705","Traffic is forwarded but connections time out at the backend","The LB automatically detects the correct port and adjusts","Only the health probe fails; traffic forwarding is unaffected"],correctIndex:0,explanation:"Health probes and load balancing rules are independent configurations. If the probe port (1434) does not get a response, all backends are marked unhealthy. When all backends are unhealthy, the LB drops all new connections on the associated rule (port 1433), even though the backends are actually listening on 1433."},{id:"az700-33-q5",question:"When should you use Gateway Load Balancer instead of a standard Load Balancer?",options:["When you need to transparently insert network virtual appliances (NVAs) into the traffic path without changing application configuration \u2705","When you need global load balancing across regions","When you need HTTP path-based routing","When you need to load balance traffic across multiple subscriptions"],correctIndex:0,explanation:"Gateway Load Balancer enables transparent chaining of NVAs (firewalls, DDoS appliances, packet inspection) into the network path. Traffic is tunneled to the NVA pool and returned without the application or client knowing about the inspection layer."},{id:"az700-33-q6",question:"Front Door uses priority-based routing to Application Gateways in two regions. What determines when traffic shifts from priority 1 to priority 2?",options:["When all origins at priority 1 fail their health probes based on the sample-size and successful-samples-required thresholds \u2705","When latency to priority 1 exceeds a configured threshold","Immediately when any single health probe fails","Based on a configured traffic percentage split"],correctIndex:0,explanation:"Front Door failover is probe-driven. Traffic shifts to priority 2 only when ALL origins at priority 1 fail health probes. The failure threshold is determined by sample-size and successful-samples-required settings in the origin group. A single probe failure does not trigger failover."}]}),"\n",(0,t.jsx)(n.h2,{id:"cleanup",children:"Cleanup"}),"\n",(0,t.jsx)(n.p,{children:"Remove all resources created in this challenge."}),"\n",(0,t.jsx)(n.h3,{id:"azure-cli-5",children:"Azure CLI"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"# Delete the entire resource group and all resources within it\naz group delete --name rg-fabrikam-multitier --yes --no-wait\n"})}),"\n",(0,t.jsx)(n.h3,{id:"azure-powershell-4",children:"Azure PowerShell"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-powershell",children:'# Delete the entire resource group and all resources within it\nRemove-AzResourceGroup -Name "rg-fabrikam-multitier" -Force -AsJob\n'})}),"\n",(0,t.jsxs)(n.admonition,{title:"Cost warning",type:"danger",children:[(0,t.jsx)(n.p,{children:"This challenge deploys multiple load balancing services. Approximate combined costs while running:"}),(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Front Door Premium: ~$35/month base"}),"\n",(0,t.jsxs)(n.li,{children:["Application Gateway WAF v2 (2 instances): ",(0,t.jsx)(n.del,{children:"$0.36/h ("}),"$260/month)"]}),"\n",(0,t.jsx)(n.li,{children:"Internal Load Balancer (Standard): ~$0.025/h per rule"}),"\n",(0,t.jsx)(n.li,{children:"Traffic Manager: ~$0.75/million queries"}),"\n"]}),(0,t.jsxs)(n.p,{children:["Delete all resources immediately after completing the challenge. The ",(0,t.jsx)(n.code,{children:"--no-wait"}
1)," flag returns control immediately while deletion proceeds in the background."]})]}),"\n",(0,t.jsxs)(n.admonition,{title:"Verify cleanup",type:"tip",children:[(0,t.jsx)(n.p,{children:"After a few minutes, confirm deletion:"}),(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:'az group show --name rg-fabrikam-multitier 2>&1 | grep -q "not found" && echo "Deleted" || echo "Still exists"\n'})})]})]})}function h(e={}){const{wrapper:n}={...(0,o.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(p,{...e})}):p(e)}},67970(e,n,r){r.d(n,{A:()=>v});var a=r(96540);const t="container_Wc2S",o="question_w8BQ",i="questionText_khaT",s="questionNumber_tNAi",l="options_hoT3",c="option_h5Gz",d="correct_wiKw",p="incorrect_jk7n",h="dimmed_Rvup",u="optionLetter_SgXF",g="optionText_qkBQ",m="checkmark_PyUX",f="crossmark__CNH",b="explanationCorrect_PaNS",x="explanationIncorrect_Ul4c",w="scoreCard_qRIf",j="perfect_Nu3_",y="good_kzz1",k="review_WPHG";var A=r(74848);function v({questions:e}){const[n,r]=(0,a.useState)({}),o=Object.keys(n).length===e.length,i=Object.values(n).filter(Boolean).length,s=(e,n)=>{r(r=>({...r,[e]:n}))};return(0,A.jsxs)("div",{className:t,children:[e.map((e,n)=>(0,A.jsx)(P,{index:n,question:e.question,options:e.options,correctIndex:e.correctAnswer??e.correctIndex,explanation:e.explanation,onAnswer:s},n)),o&&(0,A.jsxs)("div",{className:w,children:[(0,A.jsxs)("strong",{children:["Score: ",i,"/",e.length]}),i===e.length?(0,A.jsx)("span",{className:j,children:" \u2014 Perfect!"}):i>=.75*e.length?(0,A.jsx)("span",{className:y,children:" \u2014 Good job!"}):(0,A.jsx)("span",{className:k,children:" \u2014 Review the explanations above."})]})]})}function P({index:e,question:n,options:r,correctIndex:t,explanation:w,onAnswer:j}){const[y,k]=(0,a.useState)(null),[v,P]=(0,a.useState)(!1);return(0,A.jsxs)("div",{className:o,children:[(0,A.jsxs)("p",{className:i,children:[(0,A.jsxs)("span",{className:s,children:[e+1,"."]})," ",n]}),(0,A.jsx)("div",{className:l,children:r.map((n,r)=>{let a=c;return v&&(a+=r===t?" "+d:r===y?" "+p:" "+h),(0,A.jsxs)("button",{className:a,onClick:()=>(n=>{v||(k(n),P(!0),j(e,n===t))})(r),disabled:v,children:[(0,A.jsx)("span",{className:u,children:String.fromCharCode(65+r)}),(0,A.jsx)("span",{className:g,children:n}),v&&r===t&&(0,A.jsx)("span",{className:m,children:"\u2713"}),v&&r===y&&r!==t&&(0,A.jsx)("span",{className:f,children:"\u2717"})]},r)})}),v&&(0,A.jsxs)("div",{className:y===t?b:x,children:[(0,A.jsx)("strong",{children:y===t?"Correct!":"Incorrect."})," ",w]})]})}},28453(e,n,r){r.d(n,{R:()=>i,x:()=>s});var a=r(96540);const t={},o=a.createContext(t);function i(e){const n=a.useContext(o);return a.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function s(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:i(e.components),a.createElement(o.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.