AZ-305 Design infrastructure solutions Practice Question
A company deploys a web application across multiple Azure VMs in a single region. They want to distribute incoming HTTP traffic evenly across the VMs, offload SSL encryption, and provide a fixed public IP address for clients. Which Azure load balancing solution should they use?
⚠ Common exam trap
Many exam-takers confuse Layer 4 (Azure Load Balancer) with Layer 7 (Application Gateway) capabilities, leading candidates to pick Azure Load Balancer because it is the default choice for distributing traffic across VMs, but it cannot offload SSL or handle HTTP-specific features like session affinity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway
Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that supports HTTP/HTTPS traffic, SSL termination, and cookie-based session affinity. It can distribute incoming HTTP traffic evenly across VMs, offload SSL encryption to reduce backend processing, and provide a fixed public IP address (VIP) for client access. This aligns with all three requirements: load balancing, SSL offload, and a static public IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Application Gateway
Why this is correct
Azure Application Gateway is a regional, layer 7 (HTTP/HTTPS) load balancer that terminates client SSL/TLS connections at the gateway, eliminating backend SSL overhead and enabling centralized certificate management. It exposes a single, fixed public VIP for all incoming web traffic, supports cookie-based session affinity, URL-path-based routing, and WebSocket forwarding, making it the natural choice for an HTTP workload spread across multiple VMs in one Azure region. Unlike layer 4 devices, it inspects HTTP headers and can redirect traffic based on host names or paths, so it fully satisfies the requirement for SSL offloading and a stable public IP for the web application.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer operates at layer 4 (TCP/UDP) and simply forwards packets to backend VMs without inspecting HTTP payloads, so it cannot offload SSL/TLS or perform path-based routing. It can only enforce source IP affinity or five-tuple-based distribution, never cookie-based session persistence, and every backend VM must independently terminate TLS, which contradicts the stated requirement for SSL offloading. Therefore, a standard Load Balancer is unsuitable for an HTTP application that needs centralized TLS management and application-layer routing in a single region.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager is a DNS-based traffic load balancer that directs clients to endpoints based on traffic-routing methods. It does not proxy traffic, so it cannot offload SSL or provide a fixed public IP for the application.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door operates at the application layer (HTTP/HTTPS) and is designed for global load balancing across multiple regions, not for distributing traffic evenly across VMs within a single region. It lacks a single fixed public IP address for client-facing traffic, instead using anycast-based front-end hosts. This option is tempting because Front Door does offload SSL and provides HTTP routing, but it would be correct only for multi-region, latency-sensitive web applications requiring global entry points and path-based routing.
Go deeper
Related to this question
Learn chapter
Designing Azure Storage Solutions
Key term
Application Gateway Design
Application Gateway Design is the process of planning and configuring a layer 7 load balancer in Azure that routes web traffic based on URL paths, hostnames, or other HTTP rules for secure, scalable, and high-performance application delivery.
About these practice questions
Courseiva writes every AZ-305 question from scratch — 212 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.