Cloudfront practice questions

Azure Traffic Manager

Why it fails: Azure Traffic Manager operates strictly at the DNS layer, resolving public domain names to endpoints and directing clients based on routing methods such as performance, priority, or geographic proximity. Because it never sees the actual HTTP/S traffic, it cannot provide TLS termination, web application firewall (WAF) inspection, path-based routing, or content caching at the edge. For a web application that requires SSL offloading and WAF protection, Traffic Manager is only a DNS-level traffic distribution mechanism and lacks the layer 7 security and acceleration features needed.

Azure Application Gateway

Why it fails: Azure Application Gateway is a regional-only layer 7 load balancer, meaning it can handle TLS termination, WAF rules, and path/URL routing, but only for backends within a single Azure region or availability zone. It is not a global service, so a multi-region deployment would need one Application Gateway per region and still require a separate DNS-level mechanism or another global router to steer users to the correct regional gateway. While it offers similar security features to Front Door, it lacks the built-in global edge caching, anycast networking, and cross-region health-based routing that a worldwide e-commerce platform demands.

Azure Content Delivery Network (CDN)

Why it fails: Azure CDN is optimized primarily for caching and delivering static content from edge locations to reduce latency and origin load, but it does not function as a layer 7 load balancer with real-time backend health awareness. A standard Azure CDN profile does not natively provide web application firewall (WAF) inspection for every request, nor does it perform per-request routing decisions to the nearest healthy origin based on continuous health probes in the way Front Door does. Although it can improve delivery of images and video, it cannot address the need for SSL offloading to origins, WAF protection, and intelligent failover routing across multiple regions.

Azure Load Balancer (Standard)

Why it fails: Azure Load Balancer (Standard) operates at layer 4 of the OSI model, forwarding TCP and UDP traffic to backend pool members without inspecting HTTP payloads. It cannot offload SSL/TLS termination, so encrypted traffic reaches the VMs unchanged, and it does not inject X-Forwarded-For headers or support URL-path-based routing. Health probes are limited to port availability and simple TCP/HTTP checks, not application-level status, making it inadequate for a modern web application that needs centralized certificate management and session affinity.

Azure Traffic Manager

Why it fails: Azure Traffic Manager is a DNS-based global traffic router, not a proxy; it resolves client requests to an endpoint IP but does not sit in the data path, so it cannot inspect or forward HTTP requests. Because it never handles the actual connection, it cannot perform SSL termination, insert X-Forwarded-For headers, or make routing decisions based on URL paths. It relies on DNS polling and health probes to choose among endpoints, but even an HTTP probe only verifies an endpoint is reachable from Azure's perspective, not the application's health—making it unsuitable for a migration where the gateway must manage HTTPS.

Azure Front Door

Why it fails: Azure Front Door is a global layer-7 load balancer and CDN that does offer SSL termination and a WAF, but it is architected for scenarios requiring edge acceleration across multiple Azure regions via anycast. For a single-region deployment, it introduces unnecessary latency and additional cost because traffic is routed through its global edge network even when all back-ends reside in one region. Front Door also has a different feature set and session-affinity model compared to Application Gateway, so choosing it over a regional gateway complicates troubleshooting and increases operational overhead without corresponding benefit.

Azure Files with SMB protocol

Why it fails: Azure Files provides managed SMB/NFS file shares intended for lift-and-shift file servers and application sharing, not for HTTP-based web serving. It exposes no native static website endpoint, and the SMB protocol is unsuitable for anonymous internet browser clients. Serving a website from Azure Files would require an additional web server or VM to translate SMB into HTTP, making it an inefficient and awkward storage solution.

Azure Content Delivery Network only

Why it fails: Azure CDN is a caching and delivery layer that accelerates content but cannot store or serve the original website files by itself. A CDN endpoint must point to a backend origin, such as Azure Blob Storage or a web server, otherwise there is no source of truth for the content. Without a storage origin, the site has no durable, highly available files to cache, so CDN alone fails as the primary storage solution.

Azure App Service

Why it fails: Azure App Service is a fully managed compute platform designed for dynamic web apps, APIs, and background jobs that need server-side code execution. Hosting immutable static assets on App Service wastes compute resources and costs more than optimized object storage, even though it can technically serve static files. For a purely content-based site, Blob Storage paired with CDN delivers faster and more economical performance than a dedicated app-hosting tier.

Deploy AKS in three regions with Azure Traffic Manager. Use Azure Cosmos DB with multi-region writes. Use Azure Event Hubs with geo-disaster recovery. Use Azure Cache for Redis Enterprise with active geo-replication.

Why it fails: Azure Traffic Manager is a DNS-based traffic router, so regional failover depends on DNS TTL and client re-resolution, typically taking 30 seconds or more — far exceeding the 10-second RTO. Additionally, Azure Event Hubs geo-disaster recovery alone is an active-passive namespace-level failover mechanism, not an active-active pattern; without paired namespaces and client-side routing, it would still incur downtime and potential event loss during a failover. Even though Cosmos DB multi-region writes and Redis Enterprise active geo-replication provide zero-loss data services, the front-end and event ingestion layers fail the strict recovery-time objective.

Deploy AKS in two regions with Azure Front Door. Use Azure Cosmos DB with single write region and auto-failover. Use Azure Service Bus with geo-disaster recovery. Use Azure Cache for Redis Enterprise with active geo-replication.

Why it fails: Cosmos DB with a single write region and auto-failover cannot guarantee RPO=0 during a regional outage because the failover promotes a different region, and any writes that were not yet replicated to the secondary are lost. Azure Service Bus geo-disaster recovery is also active-passive: it requires a manual or scripted namespace failover and does not replicate existing queues/topics or their messages to the secondary unless you set up additional forwarding logic. This combination cannot meet the 10-second RTO or zero-data-loss requirement, and the solution is not truly active-active across regions.

Deploy AKS in two regions with Azure Front Door. Use Azure SQL Database with auto-failover groups. Use Azure Event Hubs with geo-disaster recovery. Use Azure Cache for Redis Enterprise with active geo-replication.

Why it fails: Azure SQL Database auto-failover groups are active-passive, relying on asynchronous geo-replication; a regional failover can lose recently committed transactions, so RPO=0 cannot be guaranteed. Azure Event Hubs geo-disaster recovery is likewise active-passive, requiring manual namespace failover and providing no automatic replay of missed events — this breaks the continuous-availability goal. While Azure Front Door offers fast failover and Redis Enterprise active geo-replication is appropriate, the relational and event services force a failover model rather than a true active-active one, so the architecture cannot meet the required recovery point objective or the 10-second RTO.

Azure Cosmos DB with multi-master writes and conflict resolution

Why it fails: Azure Cosmos DB multi-master writes causes every write region to contain replicas of all data, so a customer's data will be copied across all participating regions and may leave the mandated geography. The conflict resolution mechanism only manages concurrent write conflicts; it does nothing to restrict data placement. Partition-level residency is only possible with single-region writes, so multi-master writes violate strict data-residency requirements.

Azure Data Lake Storage Gen2 with geo-zone-redundant storage (GZRS)

Why it fails: Azure Data Lake Storage Gen2 with GZRS copies data asynchronously to a fixed Azure paired secondary region that you cannot select per customer, and the secondary endpoint is read-only in practice. Because GZRS provides zone redundancy in the primary region plus one predetermined geo-redundant copy, you cannot actively replicate different customer data to different regions. This service lacks per-tenant geo-targeting and active write capacity in the secondary region, making it unable to satisfy granular data-residency requirements.

Azure Blob Storage with geo-redundant storage (GRS)

Why it fails: Azure Blob Storage with GRS replicates your entire storage account asynchronously to an Azure-defined paired region, with failover performed at the account level, not the customer level. You have no ability to specify a different secondary region for each customer's data, and the secondary copy is not actively writable. Because all blobs in the account share the same geographic strategy, this option cannot enforce per-customer data residency constraints.

Block-level deduplication

Why it fails: Block-level deduplication is not natively supported by Azure Files. While Windows Server allows you to enable the Deduplication feature on a file server, Azure Files itself does not deduplicate identical blocks across files stored in a share. If you need deduplication, you must deploy a separate solution or use Windows Server's Data Deduplication on an on-premises server, not rely on Azure Files.

Support for iSCSI protocol

Why it fails: Azure Files does not support the iSCSI protocol; it offers file-level access exclusively through SMB and NFS. iSCSI is a block-level storage protocol typically used for raw volumes and not supported by Azure file share endpoints. Consequently, applications that require iSCSI targets cannot be directly migrated to native Azure Files and would need Azure Managed Disks or other block-storage options instead.

Automatic tiering of data to archive storage

Why it fails: Automatic tiering to archive storage is a feature of Azure Blob Storage lifecycle management, not Azure Files. Azure Files provides hot and cool access tiers, but there is no native archive tier for file shares; archiving to slow, infrequent-access storage is not available within the Azure Files service. Azure File Sync's cloud tiering does move files asynchronously to Azure, but it does not place them in Blob's Archive tier.

Implement Azure Blob Storage life cycle management to move data to the archive tier.

Why it fails: Azure Blob Storage lifecycle management can automatically move blobs to cool or archive tiers based on age, reducing storage costs, but it does not alter the request path or reduce the number of read transactions. In the archive tier, blobs are offline and must be rehydrated before access, adding latency and incurring additional costs per read, so this option does not address the goal of reducing read operations.

Use Azure File Sync to cache files on-premises.

Why it fails: Azure File Sync is designed to cache Azure Files shares on an on-premises Windows Server, enabling local low-latency access to file shares. It is not compatible with Azure Blob Storage and only supports Azure Files, so configuring it would have no effect on blob read operations. The underlying storage and access protocol differ from blob storage, making this option inapplicable to the scenario.

Enable Azure Storage Analytics logging to track operations.

Why it fails: Azure Storage Analytics logging collects and records request-level metrics, such as operation type, response status, and latency, but it does not intercept or rewrite client requests. Logging only produces metadata and does not cache or reduce storage reads; it can actually add overhead and consume write operations to store log files. Therefore, enabling logging helps with troubleshooting but does nothing to lower the volume of read operations.

Use Azure Traffic Manager to route traffic to the primary region.

Why it fails: Azure Traffic Manager routes traffic by publishing DNS responses that resolve to the IP addresses of the primary region’s AKS endpoint; when it detects a failure, it changes DNS responses, but the actual failover time is governed by DNS TTLs and client DNS caching, which can take minutes and is not guaranteed. It also performs endpoint health checks only at the level of a monitored endpoint (typically the domain/IP), not by probing application-specific HTTP behavior or AKS ingress health. This makes it less suitable than Azure Front Door for fast, application-aware failover of Kubernetes workloads.

Use Azure SQL Database with failover groups for the database tier.

Why it fails: Azure SQL Database failover groups use an active-passive model in which only the primary database accepts writes, while the secondary database is a readable but non-writable replica located in another region. In an unplanned outage, the failover group must promote the secondary, and because replication is asynchronous, any transactions committed to the old primary but not yet replicated can be lost, violating strict RPO or zero-data-loss goals. This is why a failover group cannot replace an active-active database like Cosmos DB with multiple write regions in a global multi-region write scenario.

Deploy the application in two EU regions with Azure Front Door and Azure SQL Database geo-replication.

Why it fails: Azure Front Door is a global-layer load balancer that terminates connections at Microsoft's nearest point of presence, but it does not enforce data residency because it routes requests to any configured origin, including origins outside the EU. While Azure SQL Database geo-replication can maintain readable secondaries for disaster recovery, failover groups and geo-replication can replicate data across regions if configured that way, and the lack of a built-in EU-only data-boundary mechanism makes this option insufficient for strict data residency requirements. Unlike Traffic Manager's simple DNS-based routing, Front Door adds WAF and global Anycast routing, but those benefits do not address the core compliance constraint.

Deploy the application in a single Azure region in Ireland with Azure Site Recovery for DR.

Why it fails: Deploying only in a single Azure region in Ireland fails the explicit requirement to maintain disaster recovery across geographically separated regions, as Azure Site Recovery replicates workloads only to a paired secondary region from a source region, and a single-region deployment provides no independent second location. Even if paired-region replication were used, Site Recovery is primarily an asynchronous DR mechanism—it does not minimize latency for active user traffic, and it can replicate data outside the EU depending on the chosen target region. Azure Site Recovery protects virtual machines through continuous replication to a recovery vault in another region, but selecting a single EU region still leaves no active-active presence for performance or resilience.

Deploy the application in a single EU region with Azure Site Recovery and Azure Redis Cache.

Why it fails: Deploying in a single EU region with Azure Site Recovery and Azure Redis Cache still does not address the requirement to minimize latency for active traffic across multiple regions, because Site Recovery is designed for disaster recovery failover, not for active request routing or load balancing. Redis Cache in a single region only caches data close to that region's compute; users located in other EU countries will still traverse the network to that one region, so latency remains high. Additionally, Site Recovery replication to a recovery region would use a paired region, but because only one region is explicitly deployed, there is no active second region to serve read/write traffic, leaving the architecture vulnerable to regional outage and failing the low-latency goal.

Azure SQL Database

Why it fails: Azure SQL Database is a relational database engine built on SQL Server technology, using T-SQL for queries and enforcing a fixed schema with tables, rows, and columns. It does not implement the MongoDB wire protocol, BSON document storage, or MongoDB query operators, so MongoDB client drivers and tools cannot connect to it. Attempting to use it as a MongoDB-compatible service would require a complete data model redesign and application rewrite, making it incorrect for hosting a MongoDB-compatible workload.

Azure Database for PostgreSQL

Why it fails: Azure Database for PostgreSQL is a fully managed relational database that uses SQL and the PostgreSQL wire protocol, storing data in tables with relational integrity and transactions. Although PostgreSQL offers JSON/JSONB data types, it does not understand MongoDB's BSON format, query language, or wire protocol, so MongoDB clients cannot communicate with it. Its query engine, indexing behavior, and partitioning model are fundamentally different from MongoDB, making it unsuitable for hosting a MongoDB-compatible service without substantial application changes.

Azure Cache for Redis

Why it fails: Azure Cache for Redis is an in-memory key-value data store based on the open-source Redis engine, optimized for caching, session state, message brokering, and transient data. Its data structures are limited to strings, hashes, lists, sets, and sorted sets, and it has no concept of BSON documents, database collections, or MongoDB aggregation pipelines. Since it doesn't expose the MongoDB wire protocol or document query capabilities, it is entirely unsuitable as a MongoDB-compatible host and is clearly incorrect for this scenario.

Azure SQL Database with active geo-replication

Why it fails: Azure SQL Database active geo-replication asynchronously replicates committed transactions to a readable secondary in a paired region, but the primary remains the sole write endpoint. All writes are applied to the primary first, and that single-region commit path cannot deliver the globally distributed, multi-master write performance this game needs. During a regional outage, failover is database-level and takes time, risking session continuity for players, and the synchronous/async replication trade-off does not match the required low-latency global writes.

Azure Redis Cache with persistence

Why it fails: Azure Redis Cache with persistence (RDB or AOF) is fundamentally a durable cache, not a transactional multi-region data store. It has a single primary node that accepts writes; writes are serialized to one region and replication to other regions is not a supported native multi-master topology. Persistence protects against restart data loss but does not provide the multi-region write consistency, conflict resolution, or distributed leader election required for a global multiplayer state store, so it fails the durability and global-write requirements.

Azure Table Storage with geo-redundancy

Why it fails: Azure Table Storage is a schemaless NoSQL key-value store that supports geo-redundant storage (GRS) for durability, but failover to the secondary region is automatic only for the entire storage account and is not a multi-region write capability. Latency is not guaranteed to be single-digit milliseconds globally because Table Storage does not provide a managed multi-master model; writes go to the primary region and the secondary is only a read-only copy after failover. For a game requiring low-latency writes from players worldwide and active-active multi-region writes, Table Storage's eventual consistency and single-writer-region limitation are disqualifying.

Azure Load Balancer (Standard).

Why it fails: Azure Load Balancer (Standard) is incorrect because it operates at Layer 4, handling only TCP/UDP packets without inspecting HTTP payloads. It cannot perform TLS termination or maintain session affinity based on application cookies, relying instead on source IP (5-tuple) affinity. While it does support HTTP health probes, it lacks the layer-7 awareness needed for this web application scenario.

Azure Traffic Manager.

Why it fails: Azure Traffic Manager is a DNS-level traffic-routing service that operates globally, not in the data path; it simply resolves domain names to endpoints based on routing methods like performance or priority. Because it doesn't see the actual HTTP requests, it cannot terminate SSL, provide cookie-based session persistence, or run HTTP health checks to the application path. It is designed for failover and load balancing across regions, making it inappropriate for a single-region application spread across availability zones.

Azure Front Door.

Why it fails: Azure Front Door offers many of the same layer-7 capabilities as Application Gateway, including SSL termination, cookie-based session affinity, and global routing, but it is a global service that routes traffic through Microsoft's edge network. Deploying Front Door for a web application confined to one region adds unnecessary latency and operational complexity because clients are directed to a global entry point before reaching the regional VM set. Application Gateway v2 provides these same features with a regional footprint, aligning with the deployment's scope and performance needs.

Azure Data Box

Why it fails: Azure Data Box is an offline data transfer appliance designed to move large volumes of data into Azure as a one-time bulk upload. It does not provide ongoing bidirectional synchronization or local caching, because the physical device is shipped back to Azure after the initial transfer. Once the data is in Azure, any subsequent changes on-premises would not automatically propagate, making it unsuitable as a persistent hybrid storage sync solution. It could only be a seeding step before deploying Azure File Sync, not a substitute for it.

Azure NetApp Files with ExpressRoute

Why it fails: Azure NetApp Files with ExpressRoute delivers low-latency access to fully managed cloud file shares, but it does not provide local caching on on-premises servers. With this option, on-premises clients must retrieve every file over the express route connection each time they access it, which reintroduces network dependency and can be slower than local storage for large working sets. ExpressRoute only improves network latency and reliability; it does not create a local replica or perform bidirectional sync with on-prem data. Thus, it lacks the core hybrid capability of caching a copy locally while keeping changes synchronized.

Azure Blob Storage with Azure Files migration

Why it fails: Azure Blob Storage with Azure Files migration refers to moving your existing on-premises files into Azure Blob storage or an Azure file share, but that is a one-time migration action, not an ongoing sync mechanism. After the migration, the on-premises server no longer has a synchronized local cache, so any new changes on-premises would not be automatically reflected in Azure. To get local caching plus continuous sync, you need Azure File Sync, which is the service specifically built for hybrid file storage. Merely migrating without a sync agent leaves two disconnected copies that will quickly diverge.

Use only availability zones in one region.

Why it fails: Availability zones are isolated datacenter pods within one Azure region, each with independent power, cooling, and network; deploying across zones protects against a single datacenter failure. But a full regional outage takes down the entire region's shared control plane, network backbone, and utility dependencies, so all zone-redundant resources can become unavailable at once. Thus zone redundancy is a high-availability tactic for failure within a region, not disaster recovery for regional loss.

Use Azure Bastion for failover routing.

Why it fails: Azure Bastion is a PaaS admin-access gateway that provides secure, browser-based RDP/SSH sessions to Azure VMs via TLS; it does not inspect application traffic or make routing decisions. It lacks health probes, origin selection, priority rules, and any data-plane connection to user requests, so it cannot reroute user traffic when a region fails. Using it for failover routing confuses administrative plane connectivity with the application data plane and would leave users with no failover at all.

Azure Blob Storage with NFS 3.0 support

Why it fails: Azure Blob Storage with NFS 3.0 support provides a POSIX-like file interface for object storage, allowing Linux clients to mount a container over NFS. However, it does not include a sync agent or cloud tiering to maintain a local cached copy on an on-premises server; it is a direct cloud access protocol, not a hybrid synchronization service. Blob storage also lacks the SMB-based file locking and Windows ACL integration that would be needed for a Windows-centric hybrid file share.

Azure Files

Why it fails: Azure Files is a fully managed cloud file share that can be accessed via SMB or NFS, but it is inherently a cloud-only service. To achieve local caching and offline access, you must deploy Azure File Sync to synchronize the share to an on-premises Windows Server, which is beyond the scope of simply using Azure Files alone. The absence of any built-in on-premises agent or tiering engine means the cloud share can only be reached over the network, failing the hybrid connectivity requirement.

Azure NetApp Files

Why it fails: Azure NetApp Files is a high-performance, fully managed storage service for cloud-native workloads, offering both SMB and NFS access. It does not include a server-based sync engine or a cloud tiering mechanism to cache data on an on-premises server; its data placement is fully within Azure, not extended to on-premises storage. While it can be accessed over ExpressRoute, it is not a replacement for Azure File Sync in a hybrid scenario that requires a local cache and bidirectional synchronization.

Deploy VMs across Azure availability zones in West US, use Azure SQL Database geo-restore to East US, and deploy a second Azure Cache for Redis instance in East US.

Why it fails: Availability zones protect only within West US, and geo-restore rebuilds from backups with recovery point objectives of hours, breaching the five-minute recovery time objective and minimising data loss. It is tempting because zones and geo-restore are low-cost, but geo-restore suits non-critical recovery, not mission-critical regional failover.

Deploy VMs in an availability set in West US, use Azure Site Recovery to replicate to East US, and configure Azure SQL Database failover group with manual failover.

Why it fails: Availability sets protect only within a single datacentre, and manual failover of the SQL failover group requires operator action, so recovery cannot be guaranteed within five minutes. It is tempting because Site Recovery and failover groups are familiar, but manual failover suits planned migrations where downtime is acceptable.

Deploy VMs in an Azure Site Recovery recovery plan to East US, use Azure SQL Database active geo-replication with auto-failover group, and deploy Azure Cache for Redis Standard tier in East US.

Why it fails: Azure Cache for Redis Standard tier has no geo-replication, so the East US cache starts empty and the recovery time objective is breached while it warms. It is tempting because Site Recovery and auto-failover groups are correct, but Standard tier suits single-region caching, not cross-region resilience.

Azure Blob Storage with read-access geo-redundant storage (RA-GRS)

Why it fails: RA-GRS asynchronously replicates blobs to a single paired secondary region, where reads are allowed via a separate endpoint (secondary blob service). Because replication is asynchronous, read-after-write consistency is not guaranteed; in a disaster or during normal operation, users can see stale data and read latency depends on network distance to that one secondary region. It also supports only one write region, so a globally distributed application with active writes in many geographies would experience high latency and no local write capability.

Azure SQL Database with active geo-replication

Why it fails: Active geo-replication creates one or more readable secondary databases in different Azure regions, but only the primary database accepts writes; any failover to a secondary is an explicit, manual operation (or via failover group policies), not an active-active architecture. The secondaries are updated asynchronously with a recovery point objective (RPO) of up to 5 seconds, so reads from a secondary can be stale; moreover, to serve low-latency reads from many global locations you'd have to manually provision many secondaries, and writes still route to a single primary. This fits high-availability disaster recovery scenarios, not multi-region read/write scalability.

Azure Files with Azure File Sync

Why it fails: Azure File Sync is a hybrid service that syncs Azure file shares to on-premises Windows Server machines, providing local caching for branch offices; it is not a globally distributed data plane for cloud-native applications. The Azure file share itself remains a single regional resource, so clients accessing it over the internet from other regions incur latency, and Azure File Sync does not offer multi-region writes with automatic conflict resolution. Its purpose is centralized file management and caching on your own servers, not global low-latency database access.

Azure Backup

Why it fails: Azure Backup is wrong because it delivers point-in-time backups via the MARS agent or MABS/DPM, storing recovery points in a Recovery Services vault with retention policies. Unlike Site Recovery, it does not continuously replicate or maintain a ready-to-start replica; restoring requires redeploying data to a new VM, so it cannot provide low-RTO failover or automatic failback for the legacy application.

Azure SQL Database

Why it fails: Azure SQL Database is wrong because it is a managed PaaS database service for new or migrated cloud SQL workloads, not a disaster recovery tool for on-premises applications. Although it offers geo-replication and failover for its own databases, it has no capability to replicate or fail over on-premises VMs or SQL Server instances, and it does not address the compute or application layer that the legacy app depends on.

Azure Traffic Manager

Why it fails: Azure Traffic Manager is wrong because it operates at the DNS layer to route user traffic to multiple published endpoints based on routing methods like priority or geographic; it does not replicate data or workload state. It can only redirect to endpoints that are already up and running, so it cannot bring the legacy application back online from Azure—it lacks the replication, replication policy, and orchestrated failover that Site Recovery provides.

Azure SQL Database

Why it fails: Azure SQL Database is a relational database service built around tables, schemas, and ACID transactions, not a purpose-built key-value store. While it can technically store key/value pairs, its query engine and indexing structures are optimized for relational operations (joins, aggregations, complex predicates), not for simple PUT/GET access patterns at massive scale. Running a highly available key-value workload on SQL Database would also require a more expensive compute and storage configuration, and it still lacks the global multi-master replication implied by the requirement.

Azure Table Storage

Why it fails: Azure Table Storage is a NoSQL key-value service, but it is a single-region data store with only read-access geo-redundant replication, not active multi-region writes. This means a regional outage can force manual failover or cause longer downtime windows, and throughput is constrained by per-account partition scale limits. Its read and write latencies are also higher than Cosmos DB's single-digit millisecond SLAs, making it a weaker fit for a highly available, low-latency key-value requirement.

Azure Cache for Redis

Why it fails: Azure Cache for Redis is an in-memory, distributed cache, not a durable persistent data store. Even with Redis persistence enabled, data lives primarily in memory and can be lost during failovers, evictions, or resharding, so it cannot serve as the authoritative source of truth for a highly available key-value application. It is best used to accelerate reads in front of a durable store, not to replace one, and it also lacks native multi-region active-active replication.

5 VMs

Why it fails: Choosing 5 VMs as a maximum is incorrect because Azure availability sets allow you to add far more than five virtual machines. The update domain logic within an availability set distributes VMs across different maintenance and reboot groups, but it does not cap the total VM count at five; update domains simply ensure that during planned Azure maintenance, not all VMs are rebooted at once, so you can continue to scale out well beyond five instances.

15 VMs

Why it fails: Selecting 15 as the limit is erroneous because there is nothing in the availability set architecture that restricts you to fifteen virtual machines. The number 15 might be mistakenly derived from the fact that a default availability set often starts with three fault domains and five update domains, yielding 3×5=15 possible placement groups, but these are merely logical partitions, not an aggregate limit on VM count. You can place multiple VMs in the same fault and update domain combination, so the total number of VMs is limited by subscription quotas rather than by this 15-product calculation.

3 VMs

Why it fails: Limiting the availability set to 3 VMs is incorrect because there is no such bound based on fault domains. While an availability set typically uses three fault domains to isolate VMs from physical hardware failures, each fault domain can host many VMs simultaneously; the fault domain count is a placement topology, not a capacity constraint. Therefore, you can exceed three VMs by placing multiple instances within each of the three fault domains to achieve high availability.