AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Load Balancer

  Why it's wrong here

  Azure Load Balancer operates at Layer 4 of the network stack, forwarding TCP and UDP traffic based on source IP, destination IP, and port. It does not examine HTTP headers, URLs, or other application-layer data, so it is incapable of path-based routing. It simply spreads all traffic arriving on a port evenly across the backend pool VMs without regard to the request content.

  When this WOULD be correct

  When you need to distribute incoming network traffic across multiple VMs or virtual machine scale sets within a region for high availability, using only TCP/UDP protocols without inspecting HTTP content.

• ✓

  Azure Application Gateway

  Why this is correct

  Azure Application Gateway is a Layer 7 web traffic load balancer that inspects HTTP requests and can route them based on URL paths, host headers, and query strings. It supports path-based routing, allowing you to direct /api traffic to one backend pool and /images to another. Additional features like SSL termination, cookie-based session affinity, and Web Application Firewall (WAF) make it ideal for web applications on multiple VMs.

• ✗

  Traffic Manager

  Why it's wrong here

  Traffic Manager works at the DNS level by resolving a domain name to a specific endpoint based on routing methods like performance, priority, or geographic. It never sees the actual HTTP request, let alone its URL path, so it cannot make application-aware routing decisions. It directs clients to different regions or endpoints but cannot distribute paths across VMs within a single web application.

  When this WOULD be correct

  You need to distribute traffic across multiple Azure regions based on endpoint health or performance, and you want to route users to the closest or most responsive region. Traffic Manager is the correct choice for global DNS-based traffic routing.

• ✗

  Network Watcher

  Why it's wrong here

  Network Watcher is a diagnostic and monitoring service, not a traffic distribution appliance. It provides tools like packet capture, NSG flow logs, and connection troubleshoot to analyze network health, but it does not intercept or route incoming HTTP traffic. Therefore, it cannot distribute load across VMs or inspect request paths.

  When this WOULD be correct

  You need to monitor network performance, diagnose connectivity issues, or capture packet traces for a virtual network. For example, 'You need to identify a connectivity issue between two VMs in different subnets' would make Network Watcher correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question