AZ-104
Deep Dive
Azure offers four load balancing services: Load Balancer (regional L4), Application Gateway (regional L7), Traffic Manager (global DNS), and Front Door (global L7). The AZ-104 evaluates which one to use in each scenario.
Contents
Azure Load Balancer distributes layer-4 TCP/UDP traffic across backends. It is regional — it cannot balance across regions. It operates with millisecond latency and is the lowest-overhead option.
SKU types
Basic (legacy)
Standard (recommended)
Key components
Frontend IP
The public or private IP that receives traffic. Can be dynamic or static.
Backend Pool
The set of VMs or VMSS that receive traffic. They can be in different subnets of the same VNet.
Health Probe
The LB periodically probes the backends. If an instance fails the probe, the LB stops sending it traffic.
Load Balancing Rule
Maps a frontend port to a backend port with a distribution algorithm (5-tuple hash by default).
Inbound NAT Rule
Maps a specific frontend port to a specific backend. Useful for direct access (e.g. RDP to a specific VM).
Outbound Rule
Configures SNAT for outbound traffic from the backend to the internet (Standard LB only).
Public vs Internal LB
Public: Frontend with a public IP. For distributing internet traffic to internal VMs.
Internal (ILB): Frontend with a private IP. For load balancing between application tiers (web tier → app tier) or from on-premises.
Distribution algorithms
5-tuple hash: source IP, destination IP, protocol, source port, destination port. Guarantees a TCP session always goes to the same backend. Default.
2-tuple hash: Source + destination IP only. Same client IP always goes to the same backend.
3-tuple hash: Source IP, destination IP, protocol.
Azure Application Gateway is a layer-7 (HTTP/HTTPS) load balancer with SSL termination, URL/host-based routing, and optional WAF. It understands HTTP content — it can make routing decisions based on URL paths or headers.
SSL Termination
Decrypts HTTPS at the gateway — the backend receives HTTP without TLS overhead. Also supports end-to-end SSL (re-encrypts to the backend).
URL-based Routing
Different routes to different backends based on the path: /api/* → API backend, /images/* → static images backend.
Multi-site Hosting
A single gateway can serve multiple sites (www.contoso.com and www.fabrikam.com) with different backends for each.
WAF Integration
WAF v2 with OWASP CRS 3.2 rules. Detection mode (log) or Prevention mode (blocks). Custom rules for exceptions.
Autoscaling (v2)
The v2 SKU scales automatically based on load. Configurable minimum and maximum instance counts. No downtime when scaling.
Session Affinity
Cookie-based affinity — the gateway sets a cookie on the client so requests in a session always go to the same backend.
Azure Traffic Manager is a DNS-based load balancer. It does not touch data traffic — it only resolves which IP/endpoint the DNS points to based on the configured routing method. It operates globally across multiple regions or endpoints.
Important: the client connects directly to the endpoint — traffic does NOT pass through Traffic Manager. Only the DNS resolution passes through it.
| Routing method | Behavior | Use case |
|---|---|---|
| Priority | Always sends to the primary endpoint; fails over to secondary if primary fails | Active/passive — DR between regions |
| Weighted | Distributes traffic according to configured weights (e.g. 70% region A, 30% region B) | Blue/green deployments, A/B testing, gradual migrations |
| Performance | Resolves to the endpoint with the lowest network latency from the client's location | Global apps — users go to the nearest region |
| Geographic | Routes based on the client's geographic region (country/continent) | Data compliance (GDPR: EU users → EU endpoints) |
| Multivalue | Returns multiple healthy endpoints in the DNS response | Applications that can use multiple IPs (IPv4/6 only) |
| Subnet | Maps source IP ranges to specific endpoints | Directing traffic from specific offices to specific endpoints |
Azure Front Door is a CDN + global L7 load balancer. It combines content acceleration, edge SSL termination, global WAF, and intelligent routing. Unlike Traffic Manager, traffic DOES pass through Azure's infrastructure (anycast).
Front Door Standard/Premium
Front Door Classic (legacy)
| Service | Layer | Scope | Protocol | When to use |
|---|---|---|---|---|
| Load Balancer | L4 | Regional | TCP/UDP | VMs in the same region, simple load balancing with no need for L7 |
| Application Gateway | L7 | Regional | HTTP/HTTPS | Web apps that need SSL termination, URL routing, WAF within a region |
| Traffic Manager | DNS | Global | Any | Failover between regions or global routing without touching HTTP traffic |
| Front Door | L7 | Global | HTTP/HTTPS | Global web apps that need CDN, global WAF, acceleration, and multi-region reach |
Classic exam trap
Traffic Manager is DNS-based — traffic does NOT pass through it. If the scenario requires WAF, SSL termination, or any inspection of HTTP content, Traffic Manager cannot do it. In that case use Application Gateway (regional) or Front Door (global). Traffic Manager only resolves which endpoint the DNS points to.
Did you get this topic?
Test what you just learned
A company has a web application deployed in East US and West Europe. They want users in Europe to automatically connect to West Europe and users in the US to East US in order to minimize latency. Which service should they use?
Put what you learned to the test with original AZ-104 exam questions.
Start AZ-104 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.