AZ-305 Design infrastructure solutions Practice Question
A company deploys a web application on Azure virtual machines (VMs) across multiple availability zones. The application needs to automatically distribute incoming HTTPS traffic, offload SSL/TLS termination, and provide session persistence. Additionally, the solution must include a Web Application Firewall (WAF) to protect against common web vulnerabilities. Which Azure load balancing solution should they use?
⚠ Common exam trap
Many candidates confuse Azure Front Door with Application Gateway because both offer WAF and SSL offload, but Front Door is optimized for global multi-region traffic management, not for intra-region zone-resilient load balancing with session persistence, which is the specific requirement in this question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway
Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that can route HTTPS traffic, offload SSL/TLS termination, and provide session persistence (cookie-based affinity). It also natively integrates a Web Application Firewall (WAF) to protect against common web vulnerabilities like SQL injection and cross-site scripting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer is a Layer 4 (transport-level) service that distributes incoming TCP and UDP traffic based on IP addresses, ports, and distribution rules using health probes. It does not inspect the HTTP payload, so it cannot perform SSL/TLS termination, cannot read or persist application cookies for session affinity, and has no integrated web application firewall. Its role is high-throughput, low-latency network load balancing, which doesn't satisfy the application-layer requirements of the scenario.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager operates purely at the DNS level, responding to client queries with the IP address of an appropriate endpoint based on routing methods such as performance, weighted, or priority, but it never sits in the actual data path between clients and the application. Because it only resolves DNS and does not proxy connections, it cannot terminate SSL, rewrite HTTP headers, maintain cookie-based session affinity, or inspect requests for web attacks. Its purpose is global traffic routing across regions, not regional Layer 7 protection and offload, making it unsuitable for the stated requirements.
- ✓
Azure Application Gateway
Why this is correct
Azure Application Gateway is a regional Layer 7 load balancer that routes HTTP/S traffic intelligently using URL paths, host headers, or other HTTP attributes, and it terminates SSL/TLS connections at the gateway to offload encryption from backend VMs. It provides cookie-based session affinity so a user's session sticks to the same server, and its built-in Web Application Firewall (WAF) blocks common exploits such as SQL injection and cross-site scripting. Autoscaling and availability-zone support make it a robust choice for production web workloads, delivering all the needed features in one regional service.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is a global load balancer for multi-region scenarios; while it supports SSL offloading and WAF, it is designed for global traffic management, not regional load balancing across availability zones within a single region.
Go deeper
Related to this question
Learn chapter
Designing Azure Storage Solutions
Key term
Application Gateway Design
Application Gateway Design is the process of planning and configuring a layer 7 load balancer in Azure that routes web traffic based on URL paths, hostnames, or other HTTP rules for secure, scalable, and high-performance application delivery.
About these practice questions
One of 212 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.