AZ-305 Design infrastructure solutions Practice Question
A company deploys a web application on Azure VMs in a single region. They need to distribute incoming HTTPS traffic across multiple VMs, offload SSL termination, and provide session persistence. Which Azure load balancing solution should they choose?
⚠ Common exam trap
Candidates often confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming all load balancers handle SSL termination, but only Layer 7 solutions like Application Gateway or Front Door can offload HTTPS traffic and provide cookie-based session persistence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway
Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that supports SSL termination, session persistence (via cookie-based affinity), and HTTP/HTTPS traffic distribution. Unlike Azure Load Balancer (Layer 4), it can inspect application-layer headers and offload SSL decryption, meeting all three requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Load Balancer (Standard SKU)
Why it's wrong here
Azure Load Balancer (Standard SKU) operates at Layer 4 of the OSI model, distributing TCP/UDP traffic based on IP address and port. While it supports health probes and session persistence via 5-tuple hashing or client IP affinity, it cannot terminate SSL/TLS, inspect HTTP headers, or provide cookie-based session affinity, making it inadequate for application-layer requirements like secure web sessions and SSL offload.
- ✓
Azure Application Gateway
Why this is correct
Azure Application Gateway is a Layer 7 load balancer that natively performs SSL termination, offloading the decryption workload from the VMs and enabling efficient certificate management. It also offers URL-based routing, cookie-based session persistence, and HTTP health probes, allowing application-aware traffic distribution across VMs within a single Azure region. These Layer 7 capabilities directly align with the web application's need for secure, sticky sessions and advanced routing.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager operates at the DNS level, using routing methods such as performance, priority, or geographic to direct clients to the most appropriate endpoint. It is designed for global multi-region failover and latency optimization rather than load balancing VMs in a single region, and it cannot terminate SSL, inspect HTTP traffic, or maintain session persistence. Although it can route to a regional load balancer, it does not replace the need for a Layer 7 solution at the application tier.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is incorrect because it is a global, multi-region service designed for distributing traffic across geographically dispersed backend endpoints, not for load balancing multiple VMs within a single Azure region. While it offers SSL termination and Layer 7 routing with session affinity, its primary function is global performance optimisation and high availability. It would be the correct choice for scenarios requiring global traffic distribution, web application firewall capabilities, or content delivery network integration across multiple regions.
Go deeper
Related to this question
Learn chapter
Multi-Region Active-Active Architecture
Key term
Application Gateway Design
Application Gateway Design is the process of planning and configuring a layer 7 load balancer in Azure that routes web traffic based on URL paths, hostnames, or other HTTP rules for secure, scalable, and high-performance application delivery.
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.