Overview
Domain 3 is about getting user traffic to the right backend quickly and reliably. Microsoft lists three functional groups. The first pairs Azure Load Balancer and Azure Traffic Manager: mapping requirements to Load Balancer features, choosing SKU and tier, public versus internal and regional versus cross-region frontends, load balancing rules, inbound NAT rules, explicit outbound rules with SNAT, Gateway Load Balancer, and DNS-based Traffic Manager routing.
The second group covers Azure Application Gateway: use cases, manual versus autoscale capacity, backend pools, health probes, listeners, routing rules, HTTP settings, TLS and rewrite rule sets. The third covers Azure Front Door: tier choice, routes, origins and endpoints, TLS termination and end-to-end encryption, caching, traffic acceleration, rules for URL rewrite and redirect, and securing origins with Private Link.
How it's tested
Delivery questions usually describe an application: protocol, geographic spread, need for path-based routing, TLS handling or caching. You choose the service, then sometimes the specific component to configure. Look for words like HTTP, global, DNS, non-HTTP, path, session affinity and cache, because each narrows the answer.
-
Sort by layer and scope
The application's protocol and user geography are given, and you pick Load Balancer, Traffic Manager, Application Gateway or Front Door.
-
Find the failing component
Backends show unhealthy or TLS errors appear, and you identify the probe, backend setting, listener or certificate at fault.
-
Configure the rule
A routing requirement such as path-based routing, port forwarding or URL redirect is given, and you pick the rule type that delivers it.
A company runs the same web API in three regions and wants users routed to the closest healthy region with TLS offload and caching at the edge. Traffic Manager is global but only answers DNS, so it cannot offload TLS or cache. Application Gateway offloads TLS but is regional. Load Balancer is layer 4. Azure Front Door combines global anycast routing, TLS termination and caching, so it fits.
Functional groups 3
Official functional groups from the Microsoft outline, in outline order.
3.1 Design and implement Azure Load Balancer and Azure Traffic ManagerLayer 4 load balancing, SKUs, NAT and outbound rules, Gateway Load Balancer and DNS routing.
- What it means
- This group covers mapping requirements to Load Balancer features, choosing a SKU and tier, public versus internal and regional versus cross-region load balancers, creating load balancing rules, inbound NAT rules and explicit outbound rules with SNAT, implementing Gateway Load Balancer to chain NVAs, and implementing Azure Traffic Manager for DNS-based global routing.
- What to understand
- Standard Load Balancer is closed by default, so backend NSGs must allow the traffic, and it supports zones and HA ports on internal frontends. The global tier fronts regional Standard load balancers with one anycast IP. Inbound NAT rules forward a frontend port to a specific VM. Outbound rules allocate SNAT ports per backend instance. Gateway Load Balancer inserts third-party appliances transparently in front of a Standard load balancer or VM public IP. Traffic Manager returns DNS answers using priority, weighted, performance, geographic, multivalue or subnet methods.
- How it shows up
- Expect a non-HTTP or TCP workload, a port forwarding need, SNAT exhaustion symptoms or a DNS failover requirement.
- Common confusion
- Thinking Traffic Manager proxies traffic; it only answers DNS, and clients then connect directly to the endpoint.
3.2 Design and implement Azure Application GatewayRegional layer 7 load balancing with listeners, rules, probes, TLS and rewrites.
- What it means
- This group covers mapping requirements to Application Gateway features, identifying use cases, choosing manual or autoscale capacity, creating backend pools, configuring health probes, listeners, routing rules and HTTP (backend) settings, configuring TLS termination and end-to-end TLS, and building rewrite rule sets for headers and URLs.
- What to understand
- Application Gateway v2 runs in a dedicated subnet and routes HTTP and HTTPS by host name or URL path. A listener binds a frontend IP, port, protocol and certificate; a basic listener serves one site and a multi-site listener matches host names. Routing rules link a listener to a backend pool and backend settings, which hold port, protocol, cookie affinity, connection draining and host name override. Custom probes check a chosen path and status range. Certificates can come from Azure Key Vault through a managed identity.
- How it shows up
- Expect path-based routing, multi-site hosting, session affinity or an unhealthy backend caused by a probe or host header mismatch.
- Common confusion
- Putting the backend certificate on the listener; the listener holds the frontend certificate, while backend settings handle backend TLS.
3.3 Design and implement Azure Front DoorGlobal layer 7 entry point with tiers, routes, caching, acceleration, rules and Private Link origins.
- What it means
- This group covers mapping requirements to Azure Front Door features and use cases, choosing the Standard or Premium tier, configuring endpoints, routes, origin groups and origins, TLS termination and end-to-end encryption, caching, traffic acceleration, rule sets for URL rewrite and redirect, and securing an origin with Azure Private Link.
- What to understand
- Front Door uses Microsoft's global edge with anycast and split TCP to shorten connection setup for distant users. Routes map domains and paths to origin groups, and health probes plus latency decide which origin serves a request. Caching can be enabled per route with query string behavior and compression. Rule sets modify requests and responses, including rewrites and redirects. Premium adds Private Link origins, so the origin can deny public access, and adds managed WAF rule sets and bot protection.
- How it shows up
- Expect a globally distributed web app with caching, TLS or private origin needs, and a question about tier or route configuration.
- Common confusion
- Choosing Standard tier when the scenario needs a Private Link origin, which only Premium supports.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Layer 4 vs layer 7
Load Balancer works on TCP and UDP; Application Gateway and Front Door understand HTTP.
- Remember
- Path routing and TLS offload require layer 7.
- Tested as
- Service selection questions.
- Trap
- Choosing Load Balancer for URL-based routing.
-
Regional vs global
Load Balancer regional tier and Application Gateway serve one region; Front Door, Traffic Manager and global Load Balancer span regions.
- Remember
- Multi-region failover needs a global service.
- Tested as
- Architecture questions.
- Trap
- Using Application Gateway alone for global failover.
-
Standard Load Balancer secure by default
Inbound flows are blocked unless an NSG allows them.
- Remember
- Add NSG rules for backend traffic.
- Tested as
- Troubleshooting questions.
- Trap
- Blaming the load balancer rule when the NSG blocks traffic.
-
Inbound NAT rule
Maps a frontend port to a port on a specific backend instance.
- Remember
- Used for direct management access per VM.
- Tested as
- Port forwarding questions.
- Trap
- Using a load balancing rule instead.
-
Outbound rules
Explicit SNAT configuration with chosen frontend IPs and port allocation.
- Remember
- More frontend IPs give more SNAT ports.
- Tested as
- SNAT exhaustion questions.
- Trap
- Ignoring NAT Gateway as an alternative.
-
Gateway Load Balancer
Chains third-party NVAs transparently to a Standard load balancer or public IP.
- Remember
- Traffic flow stays symmetric without UDRs.
- Tested as
- NVA insertion questions.
- Trap
- Building UDR chains instead.
-
Traffic Manager routing methods
Priority, weighted, performance, geographic, multivalue and subnet.
- Remember
- Geographic is for data sovereignty, performance for latency.
- Tested as
- DNS routing questions.
- Trap
- Using performance for compliance-based routing.
-
Application Gateway listener
Frontend IP, port, protocol, host names and certificate.
- Remember
- Multi-site listeners host many domains.
- Tested as
- Configuration questions.
- Trap
- Using a basic listener for several host names.
-
Backend settings
Port, protocol, affinity, draining, timeout and host name override for backends.
- Remember
- Host name override fixes App Service backends.
- Tested as
- Unhealthy backend questions.
- Trap
- Leaving the original host header for PaaS backends.
-
Autoscale vs manual
Autoscale adjusts instance count between a minimum and maximum; manual fixes the count.
- Remember
- Set a minimum to absorb sudden spikes.
- Tested as
- Capacity questions.
- Trap
- Assuming autoscale reacts instantly.
-
Front Door tiers
Standard covers content delivery and routing; Premium adds Private Link origins and advanced security.
- Remember
- Private origins require Premium.
- Tested as
- Tier questions.
- Trap
- Choosing Standard for private origins.
-
Front Door caching
Edge caching controlled per route, with query string behavior and purge.
- Remember
- Dynamic APIs often disable caching.
- Tested as
- Performance questions.
- Trap
- Caching personalized responses.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Azure load balancing services
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Azure Load Balancer | Layer 4 TCP/UDP distribution | Regional, with a global tier | Expecting path routing |
| Traffic Manager | DNS-based global routing | No data proxying or TLS | Expecting TLS offload |
| Application Gateway | Regional layer 7 with WAF option | Path and host routing in one region | Using it alone for multi-region |
| Azure Front Door | Global layer 7 edge with caching | Anycast, acceleration and WAF | Choosing it for non-HTTP traffic |
Load Balancer rule types
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Load balancing rule | Spreads a frontend port across a pool | Many instances share traffic | Using it to reach one VM |
| Inbound NAT rule | Forwards a frontend port to one instance | Targeted access | Using it for distribution |
| Outbound rule | Controls SNAT for backend egress | Outbound only | Expecting inbound effect |
Front Door Standard vs Premium
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Standard | Global routing, caching and custom WAF rules | Lower cost, no private origins | Expecting managed rule sets |
| Premium | Adds Private Link origins and managed WAF rules | Security-focused tier | Paying for it without needing those features |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Traffic Manager terminates TLS
- What candidates pick
- Use Traffic Manager to offload certificates for a global site.
- Why it looks right
- It is global like Front Door.
- Why it's wrong
- Traffic Manager only resolves DNS names to endpoints; clients connect straight to the endpoint, so it never sees TLS.
Clue to watch for Requirement includes TLS offload or caching.
-
Application Gateway is global
- What candidates pick
- Use one Application Gateway for users across continents with regional failover.
- Why it looks right
- It is the familiar layer 7 choice.
- Why it's wrong
- Application Gateway is regional; global failover needs Front Door or Traffic Manager in front of regional gateways.
Clue to watch for Backends span several Azure regions.
-
Load Balancer routes by path
- What candidates pick
- Configure a Standard Load Balancer rule to send /images to one pool.
- Why it looks right
- Load Balancer is cheaper.
- Why it's wrong
- Load Balancer works at layer 4 and cannot inspect URL paths.
Clue to watch for Requirement mentions URL paths or host names.
-
Probe fine, backend unhealthy
- What candidates pick
- Recreate the backend pool when App Service backends fail health checks.
- Why it looks right
- The pool looks misconfigured.
- Why it's wrong
- The usual cause is the host header; enable host name override in backend settings and the probe.
Clue to watch for Backend is a multitenant PaaS service.
-
NAT rule for distribution
- What candidates pick
- Use an inbound NAT rule to spread traffic across VMs.
- Why it looks right
- NAT rules also map ports.
- Why it's wrong
- Inbound NAT rules target one instance per frontend port; distribution needs a load balancing rule.
Clue to watch for Several VMs must share incoming connections.
-
Private origin on Standard
- What candidates pick
- Pick Front Door Standard and add Private Link.
- Why it looks right
- Standard is cheaper and sounds sufficient.
- Why it's wrong
- Private Link origins require the Premium tier.
Clue to watch for The origin must deny public internet access.
Answer framework
Work through these steps to pick and configure the right AZ-700 delivery service.
- Check the protocol first: HTTP or HTTPS traffic can use layer 7 services, while other TCP or UDP traffic needs Azure Load Balancer.
- Check the scope: a single region suggests Load Balancer or Application Gateway, while several regions call for Front Door, Traffic Manager or the global Load Balancer tier.
- List layer 7 needs such as path routing, multi-site hosting, TLS offload, rewrites, caching or private origins, and confirm the tier or SKU supports them.
- Map each requirement to the component: listener, routing rule, backend settings, probe, route, origin group, rule set, NAT rule or outbound rule.
- Validate health and security last by checking probes, host headers, NSGs on backends and certificate placement.
Practice question
Want more like this? The AZ-700 practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Begin by drawing a two-by-two grid with layer 4 and layer 7 on one axis and regional and global on the other, then place each service in it. Add Gateway Load Balancer as a special case for appliance insertion. Many questions are answered by that grid alone.
Next, deploy a Standard Load Balancer with two VMs and test a load balancing rule, an inbound NAT rule and an outbound rule. Notice that traffic fails until the NSG allows it. Then build an Application Gateway v2 with two sites, a path-based rule and a custom probe against App Service, and fix the host header issue yourself.
Finish with Front Door. Create a Standard profile, add routes, enable caching and add a rule set redirect, then read how Premium changes the origin options. Review Traffic Manager routing methods with short flashcards. Timed practice questions that list all four services as options are the best final check for this domain.
FAQ
How much of AZ-700 is Domain 3, Design and implement application delivery services?
Microsoft weights it at 15–20% of the exam, with three functional groups covering Load Balancer with Traffic Manager, Application Gateway and Azure Front Door.
What is the main difference between Application Gateway and Front Door?
Application Gateway is a regional layer 7 load balancer inside your VNet. Front Door is a global layer 7 service on Microsoft's edge with caching and acceleration.
Does Traffic Manager see application traffic?
No. It responds to DNS queries with the best endpoint, and clients then connect to that endpoint directly.
Why are my Standard Load Balancer backends unreachable?
Standard Load Balancer is secure by default, so check that NSGs on the backend subnet or NICs allow the traffic and the probe.
What does Gateway Load Balancer do?
It chains network virtual appliances transparently in the path of a Standard load balancer or public IP, keeping flows symmetric.
When do I need Front Door Premium?
When the origin must be reached through Private Link, or when you need managed WAF rule sets and bot protection.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 3 knowledge
You have covered Load Balancer, Traffic Manager, Application Gateway and Front Door. Check whether you can pick the right service and component for an application scenario.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the AZ-700 AI tutor Get any concept explained your way