AZ-305 Design business continuity solutions Practice Question
A business-critical App Service application must survive a full regional outage. The recovery design should fail over automatically based on endpoint health and avoid DNS-cache delay where possible. Which service should front the regional deployments?
⚠ Common exam trap
Test-takers frequently confuse Azure Traffic Manager's DNS-based global routing with Azure Front Door's Anycast-based global routing, overlooking the critical DNS-cache delay that Traffic Manager introduces.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Front Door
Azure Front Door is the correct choice because it provides global HTTP/HTTPS load balancing with automatic failover across regions based on real-time endpoint health probes. It uses Anycast routing to direct traffic to the nearest healthy region, which avoids DNS-cache delay inherent in DNS-based solutions like Traffic Manager. This ensures sub-second failover and meets the requirement for a business-critical app that must survive a full regional outage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer is a regional, Layer-4 construct that distributes traffic within a single Azure region and primarily operates at the network and transport layers (TCP/UDP). It does not perform any global routing, health-based failover across regions, or HTTP-level inspection, so it cannot redirect end users to a different region if an entire region fails. Therefore, while it can balance load across VMs in a backend pool, it is not an appropriate solution for surviving a full regional outage.
- ✗
Azure Application Security Groups
Why it's wrong here
Azure Application Security Groups are not a traffic-routing or load-balancing service at all; they are logical groupings of virtual machine network interfaces used to simplify the application of Network Security Group (NSG) rules. An ASG enables you to define security policies based on workloads (e.g., 'web servers', 'app servers') rather than individual IP addresses, but it has no mechanism for health probing, failover, or rerouting traffic. Consequently, it has zero role in ensuring business continuity across a region loss.
- ✓
Azure Front Door
Why this is correct
Azure Front Door is a global, cloud-native entry point that provides HTTP/S load balancing, SSL offload, path-based routing, and—critically—health-probe-driven automatic failover across multiple regions. By continuously probing the health of backends, Front Door can detect a regional outage and route traffic to the nearest healthy regional endpoint, typically in seconds, without relying on client DNS cache timeouts. It also supports session affinity, URL rewrite, and Web Application Firewall (WAF) policies, making it the correct choice for a business-critical web app that must survive a full region failure.
- ✗
Azure Traffic Manager only
Why it's wrong here
Azure Traffic Manager is a DNS-based traffic router that directs traffic to different regional endpoints by responding to DNS queries with the appropriate endpoint's IP address. However, because it operates only at the DNS level, it does not inspect HTTP/S traffic, and more importantly, failover is delayed by DNS TTL and client-side DNS caching—clients may keep using the old endpoint's IP even after a health check marks it down. While Traffic Manager can provide regional failover, it is less immediate and less granular than Front Door, so relying on Traffic Manager alone is a weaker choice for a business-critical app requiring fast, resilient failover.
Go deeper
Related to this question
About these practice questions
One of 795 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.