AZ-305 Design infrastructure solutions Practice Question
A company deploys a web application on Azure VMs across availability zones. They need to distribute HTTPS traffic, offload SSL termination, and maintain session persistence. They do not require traffic inspection. Which Azure load balancing solution should they use?
⚠ Common exam trap
Many exam-takers confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming any load balancer can handle SSL termination, but only Layer 7 solutions like Application Gateway or Front Door can offload SSL and maintain session persistence at the application layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway v2.
Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that supports HTTPS traffic distribution, SSL termination (offloading the decryption burden from backend VMs), and session persistence via cookie-based affinity. It meets all requirements without needing traffic inspection, which is optional and can be disabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Application Gateway v2.
Why this is correct
Azure Application Gateway v2 is the correct choice because it operates as a regional Layer 7 load balancer, directly supporting HTTPS termination, cookie-based session persistence (affinity), and HTTP health probes for backend VMs. Its v2 SKU is designed to span availability zones, enabling zone-redundant deployment across VM sets within a single region. Unlike global services, it stays in the region, minimizing latency while providing all required web-layer capabilities.
- ✗
Azure Load Balancer (Standard).
Why it's wrong here
Azure Load Balancer (Standard) is incorrect because it operates at Layer 4, handling only TCP/UDP packets without inspecting HTTP payloads. It cannot perform TLS termination or maintain session affinity based on application cookies, relying instead on source IP (5-tuple) affinity. While it does support HTTP health probes, it lacks the layer-7 awareness needed for this web application scenario.
- ✗
Azure Traffic Manager.
Why it's wrong here
Azure Traffic Manager is a DNS-level traffic-routing service that operates globally, not in the data path; it simply resolves domain names to endpoints based on routing methods like performance or priority. Because it doesn't see the actual HTTP requests, it cannot terminate SSL, provide cookie-based session persistence, or run HTTP health checks to the application path. It is designed for failover and load balancing across regions, making it inappropriate for a single-region application spread across availability zones.
- ✗
Azure Front Door.
Why it's wrong here
Azure Front Door offers many of the same layer-7 capabilities as Application Gateway, including SSL termination, cookie-based session affinity, and global routing, but it is a global service that routes traffic through Microsoft's edge network. Deploying Front Door for a web application confined to one region adds unnecessary latency and operational complexity because clients are directed to a global entry point before reaching the regional VM set. Application Gateway v2 provides these same features with a regional footprint, aligning with the deployment's scope and performance needs.
Go deeper
Related to this question
Learn chapter
Designing Azure Storage Solutions
Key term
Application Gateway Design
Application Gateway Design is the process of planning and configuring a layer 7 load balancer in Azure that routes web traffic based on URL paths, hostnames, or other HTTP rules for secure, scalable, and high-performance application delivery.
About these practice questions
This AZ-305 question is part of Courseiva's 212-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.