Cloudfront practice questions

Azure Traffic Manager

Why wrong: Azure Traffic Manager operates strictly at the DNS layer, resolving public domain names to endpoints and directing clients based on routing methods such as performance, priority, or geographic proximity. Because it never sees the actual HTTP/S traffic, it cannot provide TLS termination, web application firewall (WAF) inspection, path-based routing, or content caching at the edge. For a web application that requires SSL offloading and WAF protection, Traffic Manager is only a DNS-level traffic distribution mechanism and lacks the layer 7 security and acceleration features needed.

Azure Application Gateway

Why wrong: Azure Application Gateway is a regional-only layer 7 load balancer, meaning it can handle TLS termination, WAF rules, and path/URL routing, but only for backends within a single Azure region or availability zone. It is not a global service, so a multi-region deployment would need one Application Gateway per region and still require a separate DNS-level mechanism or another global router to steer users to the correct regional gateway. While it offers similar security features to Front Door, it lacks the built-in global edge caching, anycast networking, and cross-region health-based routing that a worldwide e-commerce platform demands.

Azure Content Delivery Network (CDN)

Why wrong: Azure CDN is optimized primarily for caching and delivering static content from edge locations to reduce latency and origin load, but it does not function as a layer 7 load balancer with real-time backend health awareness. A standard Azure CDN profile does not natively provide web application firewall (WAF) inspection for every request, nor does it perform per-request routing decisions to the nearest healthy origin based on continuous health probes in the way Front Door does. Although it can improve delivery of images and video, it cannot address the need for SSL offloading to origins, WAF protection, and intelligent failover routing across multiple regions.

Azure Load Balancer (Standard)

Why wrong: Azure Load Balancer (Standard) operates at layer 4 of the OSI model, forwarding TCP and UDP traffic to backend pool members without inspecting HTTP payloads. It cannot offload SSL/TLS termination, so encrypted traffic reaches the VMs unchanged, and it does not inject X-Forwarded-For headers or support URL-path-based routing. Health probes are limited to port availability and simple TCP/HTTP checks, not application-level status, making it inadequate for a modern web application that needs centralized certificate management and session affinity.

Azure Traffic Manager

Why wrong: Azure Traffic Manager is a DNS-based global traffic router, not a proxy; it resolves client requests to an endpoint IP but does not sit in the data path, so it cannot inspect or forward HTTP requests. Because it never handles the actual connection, it cannot perform SSL termination, insert X-Forwarded-For headers, or make routing decisions based on URL paths. It relies on DNS polling and health probes to choose among endpoints, but even an HTTP probe only verifies an endpoint is reachable from Azure's perspective, not the application's health—making it unsuitable for a migration where the gateway must manage HTTPS.

Azure Front Door

Why wrong: Azure Front Door is a global layer-7 load balancer and CDN that does offer SSL termination and a WAF, but it is architected for scenarios requiring edge acceleration across multiple Azure regions via anycast. For a single-region deployment, it introduces unnecessary latency and additional cost because traffic is routed through its global edge network even when all back-ends reside in one region. Front Door also has a different feature set and session-affinity model compared to Application Gateway, so choosing it over a regional gateway complicates troubleshooting and increases operational overhead without corresponding benefit.

Deploy AKS in three regions with Azure Traffic Manager. Use Azure Cosmos DB with multi-region writes. Use Azure Event Hubs with geo-disaster recovery. Use Azure Cache for Redis Enterprise with active geo-replication.

Why wrong: Azure Traffic Manager is a DNS-based traffic router, so regional failover depends on DNS TTL and client re-resolution, typically taking 30 seconds or more — far exceeding the 10-second RTO. Additionally, Azure Event Hubs geo-disaster recovery alone is an active-passive namespace-level failover mechanism, not an active-active pattern; without paired namespaces and client-side routing, it would still incur downtime and potential event loss during a failover. Even though Cosmos DB multi-region writes and Redis Enterprise active geo-replication provide zero-loss data services, the front-end and event ingestion layers fail the strict recovery-time objective.

Deploy AKS in two regions with Azure Front Door. Use Azure Cosmos DB with single write region and auto-failover. Use Azure Service Bus with geo-disaster recovery. Use Azure Cache for Redis Enterprise with active geo-replication.

Why wrong: Cosmos DB with a single write region and auto-failover cannot guarantee RPO=0 during a regional outage because the failover promotes a different region, and any writes that were not yet replicated to the secondary are lost. Azure Service Bus geo-disaster recovery is also active-passive: it requires a manual or scripted namespace failover and does not replicate existing queues/topics or their messages to the secondary unless you set up additional forwarding logic. This combination cannot meet the 10-second RTO or zero-data-loss requirement, and the solution is not truly active-active across regions.

Deploy AKS in two regions with Azure Front Door. Use Azure SQL Database with auto-failover groups. Use Azure Event Hubs with geo-disaster recovery. Use Azure Cache for Redis Enterprise with active geo-replication.

Why wrong: Azure SQL Database auto-failover groups are active-passive, relying on asynchronous geo-replication; a regional failover can lose recently committed transactions, so RPO=0 cannot be guaranteed. Azure Event Hubs geo-disaster recovery is likewise active-passive, requiring manual namespace failover and providing no automatic replay of missed events — this breaks the continuous-availability goal. While Azure Front Door offers fast failover and Redis Enterprise active geo-replication is appropriate, the relational and event services force a failover model rather than a true active-active one, so the architecture cannot meet the required recovery point objective or the 10-second RTO.

Block-level deduplication

Why wrong: Block-level deduplication is not natively supported by Azure Files. While Windows Server allows you to enable the Deduplication feature on a file server, Azure Files itself does not deduplicate identical blocks across files stored in a share. If you need deduplication, you must deploy a separate solution or use Windows Server's Data Deduplication on an on-premises server, not rely on Azure Files.

Support for iSCSI protocol

Why wrong: Azure Files does not support the iSCSI protocol; it offers file-level access exclusively through SMB and NFS. iSCSI is a block-level storage protocol typically used for raw volumes and not supported by Azure file share endpoints. Consequently, applications that require iSCSI targets cannot be directly migrated to native Azure Files and would need Azure Managed Disks or other block-storage options instead.

Automatic tiering of data to archive storage

Why wrong: Automatic tiering to archive storage is a feature of Azure Blob Storage lifecycle management, not Azure Files. Azure Files provides hot and cool access tiers, but there is no native archive tier for file shares; archiving to slow, infrequent-access storage is not available within the Azure Files service. Azure File Sync's cloud tiering does move files asynchronously to Azure, but it does not place them in Blob's Archive tier.

Implement Azure Blob Storage life cycle management to move data to the archive tier.

Why wrong: Azure Blob Storage lifecycle management can automatically move blobs to cool or archive tiers based on age, reducing storage costs, but it does not alter the request path or reduce the number of read transactions. In the archive tier, blobs are offline and must be rehydrated before access, adding latency and incurring additional costs per read, so this option does not address the goal of reducing read operations.

Use Azure File Sync to cache files on-premises.

Why wrong: Azure File Sync is designed to cache Azure Files shares on an on-premises Windows Server, enabling local low-latency access to file shares. It is not compatible with Azure Blob Storage and only supports Azure Files, so configuring it would have no effect on blob read operations. The underlying storage and access protocol differ from blob storage, making this option inapplicable to the scenario.

Enable Azure Storage Analytics logging to track operations.

Why wrong: Azure Storage Analytics logging collects and records request-level metrics, such as operation type, response status, and latency, but it does not intercept or rewrite client requests. Logging only produces metadata and does not cache or reduce storage reads; it can actually add overhead and consume write operations to store log files. Therefore, enabling logging helps with troubleshooting but does nothing to lower the volume of read operations.

Use Azure Traffic Manager to route traffic to the primary region.

Why wrong: Azure Traffic Manager routes traffic by publishing DNS responses that resolve to the IP addresses of the primary region’s AKS endpoint; when it detects a failure, it changes DNS responses, but the actual failover time is governed by DNS TTLs and client DNS caching, which can take minutes and is not guaranteed. It also performs endpoint health checks only at the level of a monitored endpoint (typically the domain/IP), not by probing application-specific HTTP behavior or AKS ingress health. This makes it less suitable than Azure Front Door for fast, application-aware failover of Kubernetes workloads.

Use Azure SQL Database with failover groups for the database tier.

Why wrong: Azure SQL Database failover groups use an active-passive model in which only the primary database accepts writes, while the secondary database is a readable but non-writable replica located in another region. In an unplanned outage, the failover group must promote the secondary, and because replication is asynchronous, any transactions committed to the old primary but not yet replicated can be lost, violating strict RPO or zero-data-loss goals. This is why a failover group cannot replace an active-active database like Cosmos DB with multiple write regions in a global multi-region write scenario.

Deploy the application in two EU regions with Azure Front Door and Azure SQL Database geo-replication.

Why wrong: Azure Front Door is a global-layer load balancer that terminates connections at Microsoft's nearest point of presence, but it does not enforce data residency because it routes requests to any configured origin, including origins outside the EU. While Azure SQL Database geo-replication can maintain readable secondaries for disaster recovery, failover groups and geo-replication can replicate data across regions if configured that way, and the lack of a built-in EU-only data-boundary mechanism makes this option insufficient for strict data residency requirements. Unlike Traffic Manager's simple DNS-based routing, Front Door adds WAF and global Anycast routing, but those benefits do not address the core compliance constraint.

Deploy the application in a single Azure region in Ireland with Azure Site Recovery for DR.

Why wrong: Deploying only in a single Azure region in Ireland fails the explicit requirement to maintain disaster recovery across geographically separated regions, as Azure Site Recovery replicates workloads only to a paired secondary region from a source region, and a single-region deployment provides no independent second location. Even if paired-region replication were used, Site Recovery is primarily an asynchronous DR mechanism—it does not minimize latency for active user traffic, and it can replicate data outside the EU depending on the chosen target region. Azure Site Recovery protects virtual machines through continuous replication to a recovery vault in another region, but selecting a single EU region still leaves no active-active presence for performance or resilience.

Deploy the application in a single EU region with Azure Site Recovery and Azure Redis Cache.

Why wrong: Deploying in a single EU region with Azure Site Recovery and Azure Redis Cache still does not address the requirement to minimize latency for active traffic across multiple regions, because Site Recovery is designed for disaster recovery failover, not for active request routing or load balancing. Redis Cache in a single region only caches data close to that region's compute; users located in other EU countries will still traverse the network to that one region, so latency remains high. Additionally, Site Recovery replication to a recovery region would use a paired region, but because only one region is explicitly deployed, there is no active second region to serve read/write traffic, leaving the architecture vulnerable to regional outage and failing the low-latency goal.

Azure SQL Database

Why wrong: Azure SQL Database is a relational database engine built on SQL Server technology, using T-SQL for queries and enforcing a fixed schema with tables, rows, and columns. It does not implement the MongoDB wire protocol, BSON document storage, or MongoDB query operators, so MongoDB client drivers and tools cannot connect to it. Attempting to use it as a MongoDB-compatible service would require a complete data model redesign and application rewrite, making it incorrect for hosting a MongoDB-compatible workload.

Azure Database for PostgreSQL

Why wrong: Azure Database for PostgreSQL is a fully managed relational database that uses SQL and the PostgreSQL wire protocol, storing data in tables with relational integrity and transactions. Although PostgreSQL offers JSON/JSONB data types, it does not understand MongoDB's BSON format, query language, or wire protocol, so MongoDB clients cannot communicate with it. Its query engine, indexing behavior, and partitioning model are fundamentally different from MongoDB, making it unsuitable for hosting a MongoDB-compatible service without substantial application changes.

Azure Cache for Redis

Why wrong: Azure Cache for Redis is an in-memory key-value data store based on the open-source Redis engine, optimized for caching, session state, message brokering, and transient data. Its data structures are limited to strings, hashes, lists, sets, and sorted sets, and it has no concept of BSON documents, database collections, or MongoDB aggregation pipelines. Since it doesn't expose the MongoDB wire protocol or document query capabilities, it is entirely unsuitable as a MongoDB-compatible host and is clearly incorrect for this scenario.

Azure SQL Database with active geo-replication

Why wrong: Azure SQL Database active geo-replication asynchronously replicates committed transactions to a readable secondary in a paired region, but the primary remains the sole write endpoint. All writes are applied to the primary first, and that single-region commit path cannot deliver the globally distributed, multi-master write performance this game needs. During a regional outage, failover is database-level and takes time, risking session continuity for players, and the synchronous/async replication trade-off does not match the required low-latency global writes.

Azure Redis Cache with persistence

Why wrong: Azure Redis Cache with persistence (RDB or AOF) is fundamentally a durable cache, not a transactional multi-region data store. It has a single primary node that accepts writes; writes are serialized to one region and replication to other regions is not a supported native multi-master topology. Persistence protects against restart data loss but does not provide the multi-region write consistency, conflict resolution, or distributed leader election required for a global multiplayer state store, so it fails the durability and global-write requirements.

Azure Table Storage with geo-redundancy

Why wrong: Azure Table Storage is a schemaless NoSQL key-value store that supports geo-redundant storage (GRS) for durability, but failover to the secondary region is automatic only for the entire storage account and is not a multi-region write capability. Latency is not guaranteed to be single-digit milliseconds globally because Table Storage does not provide a managed multi-master model; writes go to the primary region and the secondary is only a read-only copy after failover. For a game requiring low-latency writes from players worldwide and active-active multi-region writes, Table Storage's eventual consistency and single-writer-region limitation are disqualifying.

Azure Load Balancer (Standard).

Why wrong: Azure Load Balancer (Standard) is incorrect because it operates at Layer 4, handling only TCP/UDP packets without inspecting HTTP payloads. It cannot perform TLS termination or maintain session affinity based on application cookies, relying instead on source IP (5-tuple) affinity. While it does support HTTP health probes, it lacks the layer-7 awareness needed for this web application scenario.

Azure Traffic Manager.

Why wrong: Azure Traffic Manager is a DNS-level traffic-routing service that operates globally, not in the data path; it simply resolves domain names to endpoints based on routing methods like performance or priority. Because it doesn't see the actual HTTP requests, it cannot terminate SSL, provide cookie-based session persistence, or run HTTP health checks to the application path. It is designed for failover and load balancing across regions, making it inappropriate for a single-region application spread across availability zones.

Azure Front Door.

Why wrong: Azure Front Door offers many of the same layer-7 capabilities as Application Gateway, including SSL termination, cookie-based session affinity, and global routing, but it is a global service that routes traffic through Microsoft's edge network. Deploying Front Door for a web application confined to one region adds unnecessary latency and operational complexity because clients are directed to a global entry point before reaching the regional VM set. Application Gateway v2 provides these same features with a regional footprint, aligning with the deployment's scope and performance needs.

Azure Backup

Why wrong: Azure Backup is wrong because it delivers point-in-time backups via the MARS agent or MABS/DPM, storing recovery points in a Recovery Services vault with retention policies. Unlike Site Recovery, it does not continuously replicate or maintain a ready-to-start replica; restoring requires redeploying data to a new VM, so it cannot provide low-RTO failover or automatic failback for the legacy application.

Azure SQL Database

Why wrong: Azure SQL Database is wrong because it is a managed PaaS database service for new or migrated cloud SQL workloads, not a disaster recovery tool for on-premises applications. Although it offers geo-replication and failover for its own databases, it has no capability to replicate or fail over on-premises VMs or SQL Server instances, and it does not address the compute or application layer that the legacy app depends on.

Azure Traffic Manager

Why wrong: Azure Traffic Manager is wrong because it operates at the DNS layer to route user traffic to multiple published endpoints based on routing methods like priority or geographic; it does not replicate data or workload state. It can only redirect to endpoints that are already up and running, so it cannot bring the legacy application back online from Azure—it lacks the replication, replication policy, and orchestrated failover that Site Recovery provides.

Azure Load Balancer Standard with source IP affinity

Why wrong: Azure Load Balancer Standard is a Layer 4 load balancer that only forwards TCP or UDP packets; it cannot offload SSL/TLS, so each VM must handle encryption itself, adding CPU overhead. Source IP affinity, also called sticky sessions at Layer 4, hashes the client IP address, which can still map many users to one unhealthy VM if clients share a NAT or proxy. More importantly, it does not use HTTP cookies, so if a client's IP changes mid-session, the session is lost, making it unsuitable for the described web application.

Azure Traffic Manager with performance routing

Why wrong: Azure Traffic Manager is a DNS-level traffic router rather than a load balancer; it returns one endpoint IP in response to DNS queries and depends on TTL and health checks to redirect traffic, so it cannot distribute individual HTTP requests across the multiple named VMs. It also provides no SSL offloading or session persistence, meaning each VM would need its own SSL certificate and no cookie or source-IP stickiness exists. For a single-region deployment across availability zones, Traffic Manager adds an unnecessary DNS hop and fails to meet the web application's session-affinity requirement.

Azure Front Door with session affinity

Why wrong: Azure Front Door is a powerful global Layer 7 load balancer with cookie-based session affinity and SSL offload, but its architecture is built around edge nodes and global HTTP routing, which is overkill for a single-region, multi-VM web application. Because traffic must traverse Microsoft's edge network and be routed regionally, it introduces additional network hops and latency compared with a regional Application Gateway directly in the same region. Front Door also incurs higher cost and administrative complexity; for a single-region deployment, Application Gateway v2 provides all the required features with a lower latency path.

Use Azure Backup for the database with 5-minute log backup frequency. For the app, use Azure App Service backup with frequency to a secondary region. For AKS, back up persistent volumes using Azure Backup. Restore everything in a secondary region during disaster.

Why wrong: Backup cannot meet 1-hour RTO because restore takes time.

Deploy the entire application across two Azure Availability Zones within West US. Use zone-redundant storage for blobs, zone-redundant App Service plan, and zone-redundant AKS. For SQL Database, use a zone-redundant configuration. For Redis, use Enterprise tier with zone redundancy.

Why wrong: Availability Zones do not protect against a regional outage.

Use Azure Site Recovery to replicate all VMs (including AKS nodes) to a secondary region. For the database, use Azure SQL Database active geo-replication. For Azure Cache for Redis, replicate data via geo-replication. Use Azure Traffic Manager for frontend traffic routing.

Why wrong: ASR for AKS is not supported; also potentially more expensive.

Azure Table Storage

Why wrong: Azure Table Storage is a fully managed NoSQL key-value store, but it is not designed for native JSON documents or multi-region global distribution with automatic failover. Its data model is a flat collection of entities with typed properties, and although you can serialize JSON into a string property, you cannot natively index or query inside that JSON object. Additionally, scaling and replication require manual management, and failover is not automatic, making it unsuitable for a mission-critical global JSON database.

Azure SQL Database

Why wrong: Azure SQL Database is a relational database engine that stores data in normalized tables with enforced schemas, not as native, schema-free JSON documents. While it provides JSON functions and can store JSON in NVARCHAR columns, the JSON is not a first-class data type and any querying or indexing requires conversion or manual JSON paths. Because it is fundamentally relational and does not offer a document-native store with multi-region writes, it does not meet the NoSQL fully managed JSON database requirement.

Azure Cache for Redis

Why wrong: Azure Cache for Redis is an in-memory data store used primarily for caching, session state, and high-throughput temporary data, not a durable NoSQL database for primary JSON persistence. Although Redis can store JSON via modules or serialization, data in the cache is volatile by default and can be lost on node failures unless you implement complex persistence and replication, which still do not provide automatic database failover or elastic multi-region write support. Its core purpose is to reduce latency for read-heavy workloads, not to serve as a globally replicated, fully managed JSON database.

Azure Load Balancer

Why wrong: Azure Load Balancer is a Layer-4 (TCP/UDP) service that cannot decrypt HTTPS traffic, so it cannot perform SSL termination or inspect application-layer cookies for cookie-based session affinity. Its session persistence is limited to source-IP or 5-tuple hashing, which can misdirect users behind a common NAT gateway and is not the application-layer stickiness required by an HTTPS web application. While it does support availability-zone-aware distribution and high throughput, it lacks URL-based routing and HTTP-level health probes, making it unsuitable for this scenario.

Azure Traffic Manager

Why wrong: Azure Traffic Manager functions at the DNS level and simply resolves a domain name to an IP address chosen from a set of regional endpoints, routing traffic across separate Azure regions rather than balancing within one region's availability zones. It never sees the HTTP/HTTPS payload, so it cannot perform SSL termination, inspect paths, or set session cookies—its health checks are basic endpoint probes, not application-layer validations. For a single-region web app on VMs that needs cookie-based affinity and zone-level distribution, Traffic Manager offers no relevant capability and would be an architectural mismatch.

Azure Front Door

Why wrong: Azure Front Door operates at the application layer (HTTP/S) and can perform SSL offloading and session affinity via cookie-based persistence, but it is a global, multi-region load balancer designed for distributing traffic across regional endpoints, not for balancing traffic across VMs within a single Azure region. The scenario requires intra-region load balancing across availability zones, which Front Door does not natively support—Azure Load Balancer or Application Gateway would handle that. It is tempting because Front Door offers SSL termination and session persistence, making it a correct choice for global web applications needing accelerated delivery and cross-region failover, such as a multi-region deployment with users distributed worldwide.

Azure Load Balancer

Why wrong: Azure Load Balancer operates at Layer 4 (TCP/UDP) and simply forwards packets to backend VMs based on rules and health probes. It does not terminate SSL/TLS, inspect HTTP headers, or perform URL path-based routing, so it cannot distribute requests based on application paths such as /api or /images. For this web application scenario that requires Layer 7 traffic management, Azure Load Balancer is fundamentally inadequate.

Azure Traffic Manager

Why wrong: Azure Traffic Manager is a DNS-based traffic routing service that operates at the domain name resolution level, directing clients to an eligible regional endpoint based on routing methods like performance, priority, or geography. It cannot inspect HTTP requests, parse URL paths, or terminate TLS connections because it never sits in the data path between clients and servers. While it can provide global failover and latency-based routing, it does not meet the Layer 7 requirements of URL path routing and SSL termination.

Azure Front Door

Why wrong: Azure Front Door is incorrect because it is a global, edge-based service primarily designed for distributing traffic across multiple Azure regions or hybrid environments. While it provides URL-path-based routing and SSL/TLS termination, which are required, its global nature is not specified as a requirement for this regional Azure VM deployment. It is tempting because it performs these Layer 7 functions, and would be the correct choice for globally distributed web applications needing optimal performance, high availability, and security at the edge.

Azure Cache for Redis (Basic tier)

Why wrong: The Basic tier is a single-node cache that offers no service-level agreement, no replication, and no data persistence. If that single node restarts or the underlying VM is patched, all cached data is lost and the application experiences downtime. It is intended only for development and testing scenarios, not for any production workload that requires high availability or durable storage.

Azure Cache for Redis (Standard tier)

Why wrong: The Standard tier runs two replicas in the same Azure region, yielding a 99.9% SLA and protecting against individual node failures, but it does not support data persistence (RDB/AOF) or zone-redundant deployment. Because the replicas are typically pinned within the same datacenter/availability zone, a zone-wide outage can take the entire cache offline and any non-resilient data is lost. This tier addresses HA but fails the persistence and cross-zone durability requirements.

Azure Cache for Redis (Enterprise tier)

Why wrong: The Enterprise tier supports data persistence and zone redundancy, but it is based on Redis Enterprise, which is more expensive. While it meets requirements, the Premium tier is the appropriate and more common choice for in-region zone redundancy and persistence.