AZ-305 Design infrastructure solutions Practice Question
A company deploys a web application on Azure VMs across multiple availability zones in the East US region. They need to distribute incoming HTTPS traffic across the VMs, offload SSL termination, and ensure that client requests from the same user session are sent to the same backend VM (session persistence). Which Azure load balancing solution should they choose?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming that 'session persistence' alone is enough, but they overlook the explicit requirement for SSL termination, which only a Layer 7 solution like Application Gateway can provide.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway v2 with cookie-based affinity
Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that can offload SSL termination, distribute HTTPS traffic, and support cookie-based session affinity (also known as sticky sessions). Cookie-based affinity ensures that all requests from the same user session are routed to the same backend VM by injecting an Application Gateway-managed cookie into the client's response. This meets all three requirements: HTTPS traffic distribution, SSL offloading, and session persistence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Application Gateway v2 with cookie-based affinity
Why this is correct
Azure Application Gateway v2 is the correct choice because it operates at Layer 7, allowing it to terminate SSL/TLS and inspect HTTP headers and cookies. With cookie-based affinity, the gateway sets a session cookie to bind a client to the same backend VM for the duration of the session, which is essential for stateful web applications. Additionally, v2 supports zone-redundant deployment, enabling automatic distribution of traffic across VMs placed in different availability zones.
- ✗
Azure Load Balancer Standard with source IP affinity
Why it's wrong here
Azure Load Balancer Standard is a Layer 4 load balancer that only forwards TCP or UDP packets; it cannot offload SSL/TLS, so each VM must handle encryption itself, adding CPU overhead. Source IP affinity, also called sticky sessions at Layer 4, hashes the client IP address, which can still map many users to one unhealthy VM if clients share a NAT or proxy. More importantly, it does not use HTTP cookies, so if a client's IP changes mid-session, the session is lost, making it unsuitable for the described web application.
- ✗
Azure Traffic Manager with performance routing
Why it's wrong here
Azure Traffic Manager is a DNS-level traffic router rather than a load balancer; it returns one endpoint IP in response to DNS queries and depends on TTL and health checks to redirect traffic, so it cannot distribute individual HTTP requests across the multiple named VMs. It also provides no SSL offloading or session persistence, meaning each VM would need its own SSL certificate and no cookie or source-IP stickiness exists. For a single-region deployment across availability zones, Traffic Manager adds an unnecessary DNS hop and fails to meet the web application's session-affinity requirement.
- ✗
Azure Front Door with session affinity
Why it's wrong here
Azure Front Door is a powerful global Layer 7 load balancer with cookie-based session affinity and SSL offload, but its architecture is built around edge nodes and global HTTP routing, which is overkill for a single-region, multi-VM web application. Because traffic must traverse Microsoft's edge network and be routed regionally, it introduces additional network hops and latency compared with a regional Application Gateway directly in the same region. Front Door also incurs higher cost and administrative complexity; for a single-region deployment, Application Gateway v2 provides all the required features with a lower latency path.
Go deeper
Related to this question
Learn chapter
Designing Azure Storage Solutions
Key term
Application Gateway Design
Application Gateway Design is the process of planning and configuring a layer 7 load balancer in Azure that routes web traffic based on URL paths, hostnames, or other HTTP rules for secure, scalable, and high-performance application delivery.
About these practice questions
This AZ-305 question is part of Courseiva's 212-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.