AZ-305
Deep Dive
The load balancer matrix (global vs regional × HTTP vs non-HTTP) is one of the most reliable AZ-305 questions. Plus Azure Firewall vs NSG, WAF and DDoS Protection.
Contents
| HTTP/S (L7) | Non-HTTP (L4) | |
|---|---|---|
| Global (multi-region) | Azure Front Door Anycast, CDN, WAF, edge TLS, instant failover | Traffic Manager DNS-based, any protocol, failover subject to TTL |
| Regional | Application Gateway L7: path/host routing, WAF, TLS termination, cookie affinity, AGIC for AKS | Azure Load Balancer L4 TCP/UDP, ultra-low latency, HA ports, internal or public, zone-redundant |
Decide with 2 questions
Is the traffic HTTP/S? Yes → Front Door (global) or App Gateway (regional). No (TCP/UDP, SQL, RDP, gaming) → Traffic Manager (global) or Load Balancer (regional). One region or several? decides the row.
NSG (Network Security Group)
Azure Firewall
They don't compete: used TOGETHER
Defense in depth: Firewall in the hub for north-south and east-west traffic + NSGs on the subnets for microsegmentation. "Only allow egress to *.windowsupdate.com" → Firewall (FQDN). "Only the web subnet talks to the db subnet on 1433" → NSG.
Web Application Firewall
DDoS Protection
| Scenario | Chain |
|---|---|
| Multi-region web app with WAF and CDN | Front Door (WAF) → App Service / regional App Gateway → backends |
| Regional 3-tier app | App Gateway WAF → web tier → Internal LB → app tier → DB |
| AKS with managed ingress | App Gateway for Containers (or AGIC) → pods |
| Only accept traffic that passed through Front Door | App Gateway/NSG filtering the AzureFrontDoor.Backend service tag + X-Azure-FDID header |
| SQL Server on VMs with a listener | Internal Load Balancer (HA ports) in front of the Always On AG |
| Global online UDP game | Traffic Manager → regional public Load Balancer |
| Requirement | Service |
|---|---|
| Web app in 3 regions, fast failover, acceleration and WAF | Azure Front Door (Premium with Private Link to backends) |
| Path routing /api → pool A, /images → pool B (regional) | Application Gateway |
| Balance internal TCP 1433 with minimal latency | Internal Load Balancer |
| DNS failover for a non-HTTP service across regions | Traffic Manager (priority) |
| Egress filtered by FQDN with threat intelligence | Azure Firewall Standard |
| TLS inspection and IDPS on traffic | Azure Firewall Premium |
| Network rules by server role without managing IPs | NSG + Application Security Groups |
| Protect against the OWASP Top 10 | WAF (on Front Door or App Gateway) |
| Telemetry and SLA against DDoS attacks | DDoS Network Protection |
| RDP/SSH to VMs with no public IPs | Azure Bastion |
Did you get this topic?
Test what you just learned
A web app runs on App Service in West Europe and East US. Requirements: a single global entry point with automatic failover in seconds, protection against SQL injection and XSS at the edge, static content acceleration, and the App Services must NOT accept direct traffic from the internet. What do you design?
Put what you learned to the test with original AZ-305 exam questions.
Start AZ-305 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.