Load Balancer vs Application Gateway decision in Azure - Practice Questions

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Basic Differences

Which statement correctly describes a key difference between Azure Load Balancer and Azure Application Gateway?

A Azure Load Balancer operates at Layer 4 (Transport Layer) and routes traffic based on IP and port, while Application Gateway operates at Layer 7 (Application Layer) and routes traffic based on HTTP attributes.

B Azure Load Balancer is designed for web application firewall capabilities, while Application Gateway is only for TCP load balancing.

C Azure Load Balancer can inspect HTTP headers to make routing decisions, whereas Application Gateway only routes based on IP addresses.

D Azure Load Balancer supports SSL termination and cookie-based session affinity, while Application Gateway does not support these features.

💡 Hint

Think about the OSI layers each service works on and what kind of traffic they handle.

Azure Load Balancer works at Layer 4 and routes traffic based on IP and port without inspecting HTTP details. Application Gateway works at Layer 7 and can route based on HTTP headers, URLs, and supports SSL termination.

❓ Architecture

intermediate

Choosing the Right Service for SSL Termination

You need to offload SSL processing from your backend servers to improve performance. Which Azure service should you choose?

A Azure Load Balancer, because it supports SSL termination natively.

B Azure Load Balancer, because it can inspect HTTP headers for SSL offloading.

C Azure Application Gateway, because it supports SSL termination and can decrypt incoming HTTPS traffic.

D Neither service supports SSL termination; you must handle it on backend servers.

💡 Hint

Consider which service works at the application layer and can decrypt HTTPS traffic.

Azure Application Gateway supports SSL termination, allowing it to decrypt HTTPS traffic and forward it as HTTP to backend servers, reducing their load. Azure Load Balancer does not support SSL termination.

❓ scaling

advanced

Scaling Web Applications with Load Balancer vs Application Gateway

Your web application experiences sudden spikes in traffic. You want to scale efficiently and maintain session persistence. Which service and feature combination is best?

A Use Azure Application Gateway with cookie-based session affinity to maintain user sessions during scaling.

B Use Azure Load Balancer with source IP affinity to maintain session persistence during scaling.

C Use Azure Load Balancer with round-robin distribution without session affinity for better scaling.

D Use Azure Application Gateway without session affinity to maximize throughput during scaling.

💡 Hint

Think about which service supports cookie-based session affinity and why that matters for web apps.

Azure Application Gateway supports cookie-based session affinity, which helps maintain user sessions during scaling. Azure Load Balancer supports source IP affinity but is less effective for HTTP session persistence.

❓ tradeoff

advanced

Tradeoffs Between Cost and Features

You have a limited budget and need basic TCP load balancing without advanced HTTP features. Which Azure service is more cost-effective and appropriate?

A Azure Application Gateway, because it is cheaper and supports basic TCP load balancing.

B Azure Load Balancer, because it is cost-effective for simple TCP/UDP load balancing without extra features.

C Azure Application Gateway, because it offers all features at a lower price than Load Balancer.

D Neither service is suitable; you should use Azure Front Door for basic TCP load balancing.

💡 Hint

Consider which service is designed for simple transport layer load balancing and typically costs less.

Azure Load Balancer is designed for simple Layer 4 load balancing and is generally more cost-effective for TCP/UDP traffic without advanced HTTP features. Application Gateway is more expensive due to Layer 7 capabilities.

❓ estimation

expert

Estimating Capacity for Application Gateway

Your application gateway must handle 10,000 concurrent HTTPS connections with SSL termination. Each connection requires 1 Mbps bandwidth. What is the minimum bandwidth capacity you should provision to avoid bottlenecks?

A 10 Gbps, because 10,000 connections × 1 Mbps = 10,000 Mbps = 10 Gbps.

B 1 Gbps, because SSL termination reduces bandwidth by compressing data.

C 100 Mbps, because connections are multiplexed and bandwidth is shared efficiently.

D 20 Gbps, to allow for overhead and peak traffic spikes beyond 10,000 Mbps.

💡 Hint

Think about overhead, peak usage, and safety margins when estimating capacity.

While 10,000 connections × 1 Mbps equals 10 Gbps, you should provision extra capacity (e.g., double) to handle overhead, SSL processing, and traffic spikes, so 20 Gbps is safer.

Practice

1. Which Azure service is best suited for distributing simple network traffic quickly without inspecting the content?

easy

A. Azure Front Door

B. Azure Application Gateway

C. Azure Traffic Manager

D. Azure Load Balancer

Solution

1. Step 1: Understand the role of Azure Load Balancer

   Azure Load Balancer distributes incoming network traffic at the transport layer quickly without inspecting the content.

2. Step 2: Compare with Application Gateway

   Application Gateway works at the application layer and inspects traffic for web routing and security, which is more complex.

3. Final Answer:

   Azure Load Balancer -> Option D

4. Quick Check:

   Simple network traffic distribution = Azure Load Balancer [OK]

Hint: Simple fast traffic? Choose Load Balancer [OK]

Common Mistakes:

• Confusing Application Gateway with Load Balancer for simple traffic
• Choosing Traffic Manager which is DNS-based, not load balancing
• Assuming Front Door is for basic network traffic

2. Which of the following is the correct Azure service to use when you need SSL termination and web application firewall features?

easy

A. Azure Application Gateway

B. Azure Load Balancer

C. Azure Virtual Network

D. Azure Blob Storage

Solution

1. Step 1: Identify SSL termination and WAF support

   Azure Application Gateway supports SSL termination and has a built-in Web Application Firewall (WAF).

2. Step 2: Exclude other options

   Load Balancer does not support SSL termination or WAF. Virtual Network and Blob Storage are unrelated services.

3. Final Answer:

   Azure Application Gateway -> Option A

4. Quick Check:

   SSL termination + WAF = Application Gateway [OK]

Hint: SSL termination needs Application Gateway [OK]

Common Mistakes:

• Choosing Load Balancer for SSL termination
• Confusing Virtual Network as a load balancer
• Selecting Blob Storage which is for data storage

3. Consider a web app that requires URL-based routing to different backend pools and needs to inspect HTTP headers. Which Azure service will correctly handle this scenario?

medium

A. Azure Application Gateway

B. Azure DNS

C. Azure Load Balancer

D. Azure Content Delivery Network

Solution

1. Step 1: Analyze URL-based routing and HTTP header inspection needs

   These features require application layer (Layer 7) processing, which Azure Application Gateway provides.

2. Step 2: Exclude other services

   Load Balancer works at Layer 4 and cannot inspect HTTP headers or route based on URL. DNS and CDN do not perform routing to backend pools.

3. Final Answer:

   Azure Application Gateway -> Option A

4. Quick Check:

   URL routing + header inspection = Application Gateway [OK]

Hint: URL routing needs Application Gateway [OK]

Common Mistakes:

• Choosing Load Balancer for URL routing
• Confusing DNS with traffic routing
• Assuming CDN handles backend routing

4. You configured an Azure Load Balancer but your web app requires SSL offloading and WAF protection. What is the main issue and how to fix it?

medium

A. WAF is enabled by default on Load Balancer; disable it

B. Load Balancer needs extra SSL certificates; add them to Load Balancer

C. Load Balancer does not support SSL offloading; switch to Application Gateway

D. Load Balancer supports SSL offloading; check backend app configuration

Solution

1. Step 1: Identify Load Balancer capabilities

   Azure Load Balancer does not support SSL offloading or WAF features.

2. Step 2: Recommend correct service

   Application Gateway supports SSL offloading and WAF, so switching is necessary.

3. Final Answer:

   Load Balancer does not support SSL offloading; switch to Application Gateway -> Option C

4. Quick Check:

   SSL offloading + WAF need Application Gateway [OK]

Hint: SSL offloading needs Application Gateway, not Load Balancer [OK]

Common Mistakes:

• Trying to add SSL certs to Load Balancer
• Assuming WAF is on Load Balancer by default
• Ignoring backend app SSL settings

5. You are designing a scalable web application that requires fast network traffic distribution, SSL termination, URL-based routing, and protection against common web attacks. Which Azure architecture should you choose?

hard

A. Use Azure Load Balancer for traffic and add Azure Firewall for security

B. Use Azure Application Gateway for all traffic management and security features

C. Use Azure Traffic Manager with Azure Load Balancer for SSL termination

D. Use Azure Front Door only for all routing and security needs

Solution

1. Step 1: Match requirements to service features

   Fast network distribution, SSL termination, URL routing, and WAF protection are all provided by Azure Application Gateway.

2. Step 2: Evaluate other options

   Load Balancer lacks SSL termination and WAF; Traffic Manager does DNS routing only; Front Door is global but may not fit all needs here.

3. Final Answer:

   Use Azure Application Gateway for all traffic management and security features -> Option B

4. Quick Check:

   All-in-one routing + SSL + WAF = Application Gateway [OK]

Hint: All features together? Pick Application Gateway [OK]

Common Mistakes:

• Choosing Load Balancer without SSL or WAF
• Confusing Traffic Manager with SSL termination
• Assuming Front Door replaces Application Gateway fully