A global ticketing website receives requests from customers in Europe, North America, and Asia. Its order API lives in two Azure Regions, but payments can only be written to one authoritative regional database at a time. During a regional incident, DNS should direct users away from a failed site without turning a payment retry into a second order. An architect is asked to choose between Azure Front Door, Application Gateway, Load Balancer and Traffic Manager. The correct design depends on protocol, routing scope, inspection, TLS, and application state\u2014not on treating every load-balancing service as the same box.<\/p>\n
Microsoft AZ-305<\/strong> includes choosing an internet connectivity, routing, load-balancing and application protection architecture. The existing highly available Azure applications<\/a> specialist covers availability as an end-to-end property. This article narrows the question to entry points: which component decides where a request goes, which layer inspects it, and how a client recovers when a healthy-looking origin cannot complete the business operation.<\/p>\n Layer 4 load balancing makes decisions around transport connections, while layer 7 application delivery can use HTTP hostnames, paths, headers or other supported request attributes. DNS-based routing chooses which address a resolver returns but cannot redirect an already-established connection instantly. An architect should describe the protocol first: HTTPS web pages, UDP gaming traffic, a long-lived TCP application, and a private API are different ingress requirements.<\/p>\n Write the user’s route as a series: DNS or global edge, TLS handshake, security inspection, regional gateway, application compute, and data tier. Then mark where user identity is checked and where a write becomes irreversible. This separates a routing failure from an application consistency problem that no load balancer can solve on its own.<\/p>\n Azure Front Door is an edge-based HTTP(S) application delivery service that can optimize global routing, caching, and supported security policies. Current Standard and Premium capabilities vary, so inspect the tier when a requirement needs WAF controls, Private Link to origins or other features. The Microsoft Front Door overview<\/a> describes the supported edge model; do not assume a classic-tier option is the right baseline for a new design.<\/p>\n A multinational website may use Front Door to direct users toward healthy regional origins and cache public static assets. Keep personalized or regulated responses out of shared caching unless the cache key and authorization model explicitly make reuse safe. If a Region loses its payment database, a successful origin HTTP response from a lightweight liveness check might be misleading; origin health must represent real ability to serve the intended request path.<\/p>\n Azure Application Gateway provides regional, application-layer traffic routing for supported web workloads. It can support host- and path-based rules, TLS handling, and a Web Application Firewall tier where selected. This is useful when regional applications need an HTTP ingress boundary, backend pools, and request-aware routing inside an Azure network. A global edge and a regional gateway may work together, but every additional hop adds certificate, header forwarding, logging and failure responsibilities.<\/p>\n Design the health probes around readiness. A backend that accepts TCP port 443 may be unable to query its database. Conversely, a health probe that requires every optional analytics service to succeed can mark all targets unhealthy during a minor reporting outage. Define a narrow essential transaction for routing decisions, not a generic \u201cevery dependency up\u201d endpoint.<\/p>\n Azure Load Balancer works at the transport layer and serves supported public or internal traffic scenarios. It is appropriate when the application needs network-level connection distribution rather than HTTP path routing. Private services may use an internal load balancer for workload communication behind controlled network security groups. It cannot replace a regional layer-7 gateway when URL routing or HTTP WAF inspection is central to the requirement.<\/p>\nDecide at which layer routing must understand the request<\/h2>\n
Use Azure Front Door for supported global HTTP delivery<\/h2>\n
Use Application Gateway when regional HTTP inspection matters<\/h2>\n
Use Azure Load Balancer for transport-level scenarios<\/h2>\n