Exercise 1: Why Front Door Alone Is a Poor Fit for a Single-Region App — Possible Solution
====================================================================

The application's real requirements -- path-based routing, TLS
offload, and a web application firewall -- are all genuine Layer 7
capabilities, which both Application Gateway and Azure Front Door
support. The deciding factor here isn't the Layer-7 feature list at
all; it's the REGIONAL vs. GLOBAL distinction the chapter draws
explicitly.

Azure Front Door is built specifically as a global service, with a
real single control plane that routes traffic across multiple
regions, clouds, or hybrid deployments. This application is deployed
in only a single region -- there's no genuine multi-region traffic
for Front Door's own global routing and failover capabilities to
actually manage. Using Front Door here would mean paying for, and
adding architectural complexity from, a global routing layer that has
nothing meaningfully global to route.

Application Gateway is the regional real equivalent, purpose-built
for exactly this scenario: transitioning public traffic into a single
region's own private network with path-based routing, TLS offload,
and WAF functionality, all without any of Front Door's own
global-scope machinery.

ANSWER: Application Gateway is the right recommendation for this
single-region application. Front Door would be a poor fit not because
it lacks the required Layer 7 features, but because it's architected
for a genuinely different scope (global, multi-region) that this
single-region deployment doesn't need or benefit from.

WHY THIS WORKS AS AN ANSWER
------------------------------
This correctly identifies that the real deciding factor is scope
(regional vs. global), not feature availability, since both services
technically support the required Layer 7 capabilities -- directly
applying the chapter's own explicit regional/global categorization
rather than just picking a service based on its feature list alone.