AZ-305 Design infrastructure solutions Practice Question
A company deploys a web application on Azure virtual machines (VMs) across multiple availability zones in the East US region. The application receives HTTPS traffic. They need to distribute incoming traffic across the VMs, offload SSL/TLS termination, and ensure that client requests from the same user session are always sent to the same backend VM (session persistence). Which Azure load balancing solution should they choose?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming any load balancer can handle SSL termination and session persistence, but only Layer 7 solutions like Application Gateway or Front Door provide cookie-based affinity and SSL offload.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway
Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that supports SSL/TLS termination, cookie-based session persistence (affinity), and can distribute HTTPS traffic across VMs in multiple availability zones. These features directly match all three requirements: SSL offloading, session persistence, and cross-zone traffic distribution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer is a Layer-4 (TCP/UDP) service that cannot decrypt HTTPS traffic, so it cannot perform SSL termination or inspect application-layer cookies for cookie-based session affinity. Its session persistence is limited to source-IP or 5-tuple hashing, which can misdirect users behind a common NAT gateway and is not the application-layer stickiness required by an HTTPS web application. While it does support availability-zone-aware distribution and high throughput, it lacks URL-based routing and HTTP-level health probes, making it unsuitable for this scenario.
- ✓
Azure Application Gateway
Why this is correct
Azure Application Gateway is a regional Layer-7 load balancer that terminates SSL and decrypts incoming HTTPS requests, enabling it to inspect HTTP headers and route based on URL paths. It natively provides cookie-based session affinity using the Application Gateway Affinity cookie, which reliably pins a client session to the same backend VM across availability zones. With additional features like URL path-based routing, WebSocket support, and optional WAF integration, it is the appropriate choice for distributing HTTPS traffic to VMs within a single region.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager functions at the DNS level and simply resolves a domain name to an IP address chosen from a set of regional endpoints, routing traffic across separate Azure regions rather than balancing within one region's availability zones. It never sees the HTTP/HTTPS payload, so it cannot perform SSL termination, inspect paths, or set session cookies—its health checks are basic endpoint probes, not application-layer validations. For a single-region web app on VMs that needs cookie-based affinity and zone-level distribution, Traffic Manager offers no relevant capability and would be an architectural mismatch.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door operates at the application layer (HTTP/S) and can perform SSL offloading and session affinity via cookie-based persistence, but it is a global, multi-region load balancer designed for distributing traffic across regional endpoints, not for balancing traffic across VMs within a single Azure region. The scenario requires intra-region load balancing across availability zones, which Front Door does not natively support—Azure Load Balancer or Application Gateway would handle that. It is tempting because Front Door offers SSL termination and session persistence, making it a correct choice for global web applications needing accelerated delivery and cross-region failover, such as a multi-region deployment with users distributed worldwide.
Go deeper
Related to this question
Learn chapter
Designing Azure Storage Solutions
Key term
Application Gateway Design
Application Gateway Design is the process of planning and configuring a layer 7 load balancer in Azure that routes web traffic based on URL paths, hostnames, or other HTTP rules for secure, scalable, and high-performance application delivery.
About these practice questions
Courseiva writes every AZ-305 question from scratch — 212 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.