Memory hook: DNS answers names; Layer 4 forwards connections; Layer 7 routes application requests.
Must remember
- Azure DNS hosts authoritative public zones; domain registration is a separate function. Delegate with the correct name servers. Private DNS zones require links to the VNets that need resolution; autoregistration is a specific feature, not universal record creation.
- Azure DNS Private Resolver supports hybrid resolution through inbound/outbound endpoints and forwarding rulesets. Avoid loops and test from the real client network. DNS TTL and negative caching can make a corrected record appear stale.
- Azure Load Balancer operates at Layer 4 for supported TCP/UDP traffic, with public or internal frontends, backend pools, probes and rules. Probe success depends on the actual response and permitted probe path. An inbound NAT rule is not the same as balancing to a pool.
- Application Gateway provides regional HTTP/S routing and WAF integration. Front Door provides global HTTP/S application delivery and edge features. Traffic Manager uses DNS routing and is not a reverse proxy for every request.
- TLS can terminate at an application gateway/edge, with a separate encrypted connection to the origin where configured. Host headers, certificate names, SNI and backend settings must align. A valid frontend certificate does not prove origin TLS works.
- Troubleshoot the client DNS answer, frontend connectivity, rule, backend health and application listener in order. A health probe can be too shallow: test a path that reflects usable service without making every shared dependency trigger an unnecessary fleet-wide outage.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| Regional path-based HTTP routing | Application Gateway. |
| Global HTTP application delivery | Front Door. |
| TCP/UDP load distribution | Azure Load Balancer. |
Traps
- Traffic Manager decisions can remain cached.
- A healthy probe is only as useful as its tested condition.
- Private-zone association is not inherited through every network connection.
Active recall
1. Which service uses DNS-based routing?
Traffic Manager.
2. Why can a backend be healthy but a request fail?
The probe may test a different port/path or omit the failing dependency.
3. What should be checked for an origin certificate error?
Trust, expiry, hostname/SNI and the configured backend TLS connection.
4. Does owning a DNS zone register the domain?
No. Registration/delegation and zone hosting are separate.
5. What makes an internal load balancer internal?
Its frontend is addressed for private network use rather than a public frontend.