Microsoft AZ-700: Load Balancing & Traffic Management — Study Guide

By Laurynas Brazys · 1 August 2026 · #microsoft #az-700 #certification #exam-prep #study-guide

Part of the Microsoft Azure Network Engineer AZ-700 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Core Azure Load Balancing and Edge Services

Azure provides several, purpose-built layers for distributing traffic: Azure Load Balancer (Layer 4), Application Gateway (Layer 7), Front Door (global edge delivery and routing), and Traffic Manager (DNS-based routing). Choose Azure Load Balancer Standard for production TCP/UDP east-west and north-south scenarios where high throughput, zone-redundancy, and predictable SNAT behavior are required; the Basic SKU is limited and not recommended for critical workloads. Application Gateway v2 supports autoscaling, zone-redundancy, WAF (WAF_v2), and native URL- and host-based routing for HTTP/S traffic, while v1 lacks autoscale and has capacity planning overhead. Front Door (Standard/Premium) provides global Anycast, TLS termination at the edge, fast failover, and a rules engine for header and path modification; Premium adds advanced WAF and private origin support. Traffic Manager is DNS-based and useful for geo-routing, failover, and weighted distribution but cannot provide TLS termination, nor can it act as an HTTP reverse proxy. When pairing services, push static assets to a CDN and use Front Door for global routing and Application Gateway for regional L7 policies and private backend access. Consider these SKU comparisons when selecting components:

Azure Load Balancer: Basic vs Standard (choose Standard for production: zone-redundant, secure by default).
Application Gateway: v1 vs v2 (v2 for autoscale, faster WAF updates).
Front Door: Standard vs Premium (Premium for advanced WAF and private link to origins).

Health Probes, Rewrite Rules, and Web Application Firewall Behavior

Health probes and WAF controls are central to resilient Layer 7 operations. Configure health probes with realistic endpoints that exercise the full request path (including authentication headers if required) and match the backend behavior; set probe interval and unhealthy thresholds to balance detection speed against false positives. Application Gateway health probes can override the host header and probe a specific path; ensure backend HTTP settings (cookie-based affinity, connection draining, idle timeouts) match application needs. Rewrite rules exist in both Application Gateway and Front Door rule engines and should be used to normalize headers, strip or insert prefixes, or perform URL rewrite for backend routing, but remember that rewrites can break caching heuristics and signed URLs. WAF policies differ by platform: Application Gateway WAF protects regional backends with OWASP-managed rules and custom exclusions, while Front Door Premium WAF protects at the edge and supports global policies, bot protection, and advanced rate-limiting. Common traps include probing a static health page that passes while app endpoints are failing, forgetting to allow probe IP ranges in NSGs, and misconfiguring host headers so backends reject probe requests.

Global Traffic Management: Front Door, Traffic Manager, and CDN

Front Door and Traffic Manager address global distribution but operate differently. Front Door functions as a global, stateful HTTP/S proxy with edge TLS termination, intelligent routing (latency, priority, and dynamic site acceleration), a built-in CDN cache layer, and a rules engine for header/path manipulation. Traffic Manager is a DNS-based selector for endpoints using routing methods like priority, weighted, performance, and geographic; it excels for simple failover and compliance routing but cannot offload TLS or perform application-layer rewrites. Azure CDN (Standard Microsoft, Standard Verizon, Premium Verizon/Akamai options) is optimized for static and cacheable content and can be fronted by Front Door or used independently; choose Premium CDN for complex rules engines, origin shield, and advanced SSL options. For multi-site routing, use host-based listeners in Application Gateway for regional segregation and Front Door for cross-region multi-site fronting with custom domains. Be mindful that DNS caching affects Traffic Manager failover speed, Front Door provides rapid edge failover, and CDN origin configuration should align with purge and TTL strategies to avoid stale content. For private origin scenarios, Front Door Premium supports Private Link to secure origins; otherwise, consider Application Gateway in a regional hub.

Design Trade-offs, Operational Traps, and Monitoring

Design decisions weigh performance, cost, and resilience. Prioritize Front Door or CDN for global delivery and lower client latency, Application Gateway for rich L7 policy controls near the backend, and Azure Load Balancer Standard for raw TCP/UDP throughput and predictable scaling. Cost trade-offs include Front Door Premium/WAF and Application Gateway v2 autoscale vs lower-cost, manual-scale v1 alternatives; balance cost by consolidating global routing at the edge while retaining regional gateways for private traffic inspection. Operational traps include SNAT port exhaustion when many backends initiate outbound connections from a small set of NAT addresses—use NAT Gateway or Adjust SNAT settings and avoid hairpinning traffic through the same NAT. Another common issue is forgetting to open probe IPs in NSGs or misconfiguring custom domains and certificates for Front Door and App Gateway. For monitoring, enable diagnostic logs and metrics for each service (Load Balancer, App Gateway, Front Door, CDN), ship to Log Analytics, and use Network Watcher’s Traffic Analytics and Connection Monitor for flow-level visibility. Configure alerts on probe failures, backend throughput anomalies, and WAF detections, and test failover with controlled traffic to validate runbooks and rollback procedures.

Practical Problem: Use-Case Scenario

Scenario: Contoso Manufacturing operates a multi-region Azure environment with two regional hubs (EastUS and WestEurope), regional Application Gateway v2 instances, a pair of VM-scale app pools, and an existing CDN for static assets. They need to present a single global endpoint with edge WAF and fast failover while preserving private regional inspection.

Challenge: Provide a global HTTPS endpoint with edge WAF, rapid cross-region failover, and the ability to route traffic to regional Application Gateway backends (which are private) without exposing origins publicly.

Recommended Approach:

Deploy Azure Front Door Premium as the global entry point (SKU: Front Door Premium) with TLS termination, enable Front Door WAF policy (custom rules + OWASP), and configure a backend pool for each region pointing to the public IP of a regional Application Gateway v2 with Private Link enabled for secure origin connectivity.
Configure Front Door’s origin as Private Link to the Application Gateway regional frontend, and set health probes to a protected health endpoint that the Application Gateway exposes; set low probe intervals (e.g., 10s) and aggressive unhealthy threshold (e.g., 3) for rapid failover.
Keep Application Gateway v2 in each region for L7 routing, URL rewrite, and local WAF rules tailored to regional policies; enable autoscaling and diagnostic logs to Log Analytics.
Use Azure CDN (Standard Microsoft) for cacheable static assets, fronted by Front Door for optimal TTL and purge control; implement monitoring and alerts on Front Door probe failures and WAF blocking rates.

Rationale: Front Door Premium provides edge WAF and rapid global failover while Private Link secures regional gateways as origins; regional Application Gateway v2 enables granular L7 controls and inspection without exposing backend VMs, balancing performance, security, and resilience.

← Network Security · All domains · Network Monitoring →

Practice these questions → · Timed practice on ExamRoll.io →