Pariksha Pe Charcha 2026 is a national-level digital initiative designed to support students, teachers, and parents by promoting healthy approaches to examination preparation and mental well-being.
The platform requires a secure, scalable, and highly available cloud infrastructure capable of supporting large-scale user participation across the country.
This document outlines the proposed cloud architecture and security framework for hosting the Pariksha Pe Charcha 2026 platform on Microsoft Azure, in alignment with government IT and security best practices.
Objectivesof the Cloud Setup
The primary objectives of the proposed cloud architecture are:
- Ensure high availability during peak national events
- Provide secure access to all users
- Support scalable enrollment and participation
- Protect sensitive student and teacher data
- Enable centralized monitoring, logging, and auditability
Business Challenges
- sudden Traffic Surge: User requests increased rapidly from <1,000 to ~20,000, causing backend overload.
- Auto-Scaling Delay: VM Scale Set did not scale fast enough to handle the sudden spike.
- Application Errors: Encountered installation error 4109 during deployment, later resolved.
- Access Issues: HTTP 403 errors occurred due to authentication and authorization misconfiguration.
- Gateway Failures: HTTP 502 Bad Gateway errors observed due to backend and database response delays.
- Database Connectivity: Intermittent Azure SQL database connection failures under high load.
What did
Tech4logic
- Proposed Cloud Architecture Overview
The platform is hosted on Microsoft Azure using a layered and modular architecture, combining Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) components.
Key architectural components include:
- Azure Application Gateway
- Azure Firewall
- Virtual Machine Scale Sets (VMSS)
- Azure Database for MySQL
- Azure Cache for Redis
- Azure CDN
🛠️ Solution & Implementation Approach
The deployment followed a structured and phased methodology to minimize risk and ensure smooth transition:
Network & Security Architecture
1 Network Design
A Hub-and-Spoke Virtual Network architecture is implemented:
- Hub Network
Hosts shared security and monitoring services such as Azure Firewall and logging.
- Hub Network
- Spoke Network
Hosts application servers, databases, and supporting services.
- Spoke Network
This design ensures network isolation, centralized security, and scalability.
4.2 Perimeter & Application Security
- Azure Application Gateway is deployed as the internet-facing component.
- All incoming traffic is restricted to HTTPS only.
- Web Application Firewall (WAF) is enabled to protect against common web threats.
This ensures secure and controlled access to the platform.
4.3 Network Security Controls
- Azure Firewall is deployed as a centralized security control point.
- DNAT, network rules, and application rules are configured to allow only authorized traffic.
- Outbound traffic is restricted and monitored.
This provides strong perimeter security and compliance readiness.
- Compute & Application Layer
- Web and application services are hosted on Azure Virtual Machine Scale Sets (VMSS).
- Auto-scaling policies are configured to handle variable user load.
- Dedicated virtual machines are used for logging, analytics, and administrative access.
This ensures high availability, performance, and operational stability.
- Data Management & Storage
- Azure Database for MySQL (PaaS) is used for storing application data.
- The database is configured with zone redundancy to ensure resilience.
- Read replicas are used for reporting and analytics.
- Database access is restricted to private networks only.
This guarantees data security, reliability, and scalability.
- Performance Optimization
- Azure Cache for Redis is used for session management and caching frequently accessed data.
- Azure CDN is used to deliver static content efficiently to users across regions.
These services significantly improve response times and user experience.
- Identity & Access Management
- Administrative access is managed through Azure Entra ID.
- Role-Based Access Control (RBAC) is enforced following the principle of least privilege.
- A secure Jump VM is used for backend administrative operations.
This prevents unauthorized access and strengthens operational security.
- Monitoring, Logging & Compliance
- Azure Monitor and Log Analytics are enabled for infrastructure and application monitoring.
- Logs are collected from firewalls, gateways, VMs, and databases.
- Alerts are configured for performance, availability, and security events.
This ensures proactive monitoring, incident response, and audit readiness.
- Backup & Disaster Recovery
- Automated backups are enabled for databases.
- Virtual machine backups are configured as per retention policy.
- Security & Compliance Summary
The proposed architecture ensures:
- Secure network isolation
- Data encryption at rest and in transit
- Controlled access to administrative resources
- Continuous monitoring and logging
- Compliance with government IT security guidelines
Conclusion
The proposed Microsoft Azure cloud architecture provides a secure, scalable, and resilient platform for Pariksha Pe Charcha 2026.
It is designed to support nationwide participation while ensuring data protection, operational efficiency, and high availability in line with government and institutional requirements.
