AZ-305 Design infrastructure solutions Practice Question
A company deploys a web application across multiple Azure VMs in a single region. They need to distribute incoming HTTP traffic, offload SSL termination, and perform URL-based routing to different backend pools (e.g., /images to one pool, /api to another). Which Azure load balancing solution should they use?
⚠ Common exam trap
Many candidates confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming all load balancers can handle HTTP routing and SSL termination, but only Layer 7 solutions like Application Gateway or Front Door can perform URL-based routing and SSL offloading.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway
Azure Application Gateway is a Layer 7 load balancer that can distribute HTTP traffic, offload SSL termination, and perform URL-based routing to different backend pools. This directly matches the requirements for routing /images and /api traffic to separate pools while handling SSL termination at the gateway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Application Gateway
Why this is correct
Azure Application Gateway is the correct choice because it operates at Layer 7 (HTTP/HTTPS), enabling URL path-based routing to distribute traffic to backend Azure VM pools based on request paths. It also provides SSL termination at the gateway, reducing the backend VMs' TLS processing overhead, and supports features like cookie-based session affinity, Web Application Firewall (WAF), and autoscaling—all within a single Azure region, which directly matches the deployment architecture.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer is incorrect because it works at Layer 4 (TCP/UDP) and makes forwarding decisions based solely on IP address, port, and protocol. It cannot inspect HTTP request URLs or headers, so it is unable to perform path-based routing or SSL offload, both of which are necessary for the web application's requirements. A Load Balancer is better suited for low-latency L4 traffic, such as non-HTTP workloads or when you only need simple distribution of TCP/UDP connections.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager is incorrect because it is a DNS-based traffic controller that routes clients to different endpoints—such as VMs across regions—at the domain resolution level, not at the HTTP request layer. It cannot inspect URL paths, terminate TLS, or maintain session affinity, and it is designed for global load balancing across multiple Azure regions rather than distributing traffic among VMs within a single region. Since the deployment is single-region, Traffic Manager would not provide the required URL-based routing or SSL offload capabilities.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is unsuitable here because the requirement specifies distributing traffic to multiple Azure VMs within a **single region**. Front Door is a global load balancing service designed for distributing traffic across *multiple regions* to provide optimal performance and high availability for geographically dispersed users. While it offers SSL termination and URL-based routing, making it tempting, its primary purpose is global traffic management. It would be the correct choice if the application needed a global entry point, WAF, or distribution across different Azure regions for a multi-regional architecture.
Go deeper
Related to this question
Learn chapter
Designing Azure Storage Solutions
Key term
Application Gateway Design
Application Gateway Design is the process of planning and configuring a layer 7 load balancer in Azure that routes web traffic based on URL paths, hostnames, or other HTTP rules for secure, scalable, and high-performance application delivery.
About these practice questions
One of 212 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.