4.4 - Load Balancer, Application Gateway and private endpoints
AZ-104 objective 4.4 covers distributing and securing traffic. Azure Load Balancer works at layer 4; the Standard SKU is required to use availability zones and carries a 99.99 percent SLA, and heavy outbound traffic can exhaust SNAT ports, which you fix most directly by adding a NAT gateway or more frontend IP addresses. A high-availability-ports rule load-balances all ports and all protocols to a backend pool at once, which is useful in front of a firewall network virtual appliance. Application Gateway is a layer-7 web load balancer that must sit in its own dedicated subnet: SSL/TLS offload decrypts HTTPS at the gateway so backend servers receive plain HTTP and are relieved of TLS work, path-based routing sends requests for /images/* and /api/* to different backend pools on the same site, and an HTTP setting defines the port, protocol and probe the gateway uses to reach the backend pool. A private endpoint gives a service a private IP inside your VNet, but a VM in a peered VNet often cannot resolve it to that private IP until the relevant Private DNS zone is linked to the peered network. Expect scenarios that ask which load-balancing or connectivity feature fits.
Zones and a 99.99 percent SLA = Standard Load Balancer; SNAT exhaustion = add a NAT gateway. Decrypt HTTPS at the edge = SSL offload; route by URL path = Application Gateway. Resolve a private endpoint from a peer = link the Private DNS zone.
Practice questions
1. You need layer-7 load balancing that routes HTTP requests to different backend pools based on the URL path. Which service should you use?
- Azure Application Gateway (correct answer)
- A basic public Azure Load Balancer that operates only at the transport layer, which is layer 4
- Azure Firewall
- A user-defined route
Application Gateway is a layer-7 load balancer that supports URL path-based and host-based routing, plus WAF. The Azure Load Balancer works at layer 4 only, Azure Firewall is a network security service, and a UDR just directs routing.
2. A VM must reach an Azure Storage account over a private IP inside your VNet, keeping the traffic off the service's public endpoint. What should you create?
- A private endpoint (correct answer)
- A service endpoint that still routes the traffic to the storage service's own public IP address range
- A public IP address
- A VPN gateway
A private endpoint gives the storage account a private IP inside your VNet, so traffic never uses the public endpoint. A service endpoint still targets the service's public IP (over the backbone), a public IP is the opposite goal, and a VPN gateway links networks.
3. You are deploying a VPN gateway into a virtual network. What must the subnet that hosts it be named?
- GatewaySubnet (correct answer)
- Any descriptive name you like, provided it is at least a /27 in size to allow for future scaling
- AzureBastionSubnet
- DefaultSubnet
A VPN or ExpressRoute gateway must live in a subnet named exactly GatewaySubnet; Azure uses that reserved name to place the gateway. An arbitrary name will not work.
4. Deploying Azure Bastion into a VNet requires a dedicated subnet with a specific reserved name. Which name?
- AzureBastionSubnet (correct answer)
- BastionHostSubnet, which Azure creates automatically the instant you enable the Bastion service
- GatewaySubnet
- ManagementSubnet
Azure Bastion requires a subnet named exactly AzureBastionSubnet, at least /26. The service does not auto-create it under any other name.
5. At which OSI layer does Azure Load Balancer distribute traffic?
- Layer 4 (correct answer)
- Layer 7, inspecting the HTTP host header and URL path of every incoming request
- Layer 3
- Layer 2
Azure Load Balancer is a layer-4 (transport) service that distributes TCP and UDP flows using a hash of the five-tuple. Layer-7 HTTP-aware routing is the job of Application Gateway, not Load Balancer.
6. Which Load Balancer SKU is required to use availability zones and offers a 99.99% SLA?
- Standard (correct answer)
- Basic, the legacy free tier that has no published SLA and is scheduled for retirement
- Gateway
- Premium
The Standard SKU supports availability zones and carries a 99.99% SLA. The Basic SKU is zone-unaware, has no SLA, and is being retired. There is no Premium load balancer SKU, and Gateway Load Balancer is a separate product for NVAs.