AZ-305 Design infrastructure solutions Practice Question
A company deploys a web application on Azure VMs. They need to distribute incoming HTTP and HTTPS traffic based on the URL path: requests to /api/* go to one VM pool, requests to /images/* go to another pool. They also need to offload SSL/TLS termination. Which Azure load balancing solution should they use?
⚠ Common exam trap
Many candidates confuse Azure Application Gateway (regional layer-7 routing) with Azure Front Door (global layer-7 routing) or Azure Load Balancer (layer-4), failing to recognize that only Application Gateway provides both URL path-based routing and SSL termination for a single-region deployment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway
Azure Application Gateway is a layer-7 load balancer that can route traffic based on URL path (e.g., /api/* vs /images/*) and provides SSL/TLS termination at the gateway, offloading the decryption from the backend VMs. This matches both requirements exactly, whereas other solutions either lack layer-7 path-based routing or are designed for global traffic distribution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer operates at Layer 4 (TCP/UDP) and simply forwards packets to backend VMs based on rules and health probes. It does not terminate SSL/TLS, inspect HTTP headers, or perform URL path-based routing, so it cannot distribute requests based on application paths such as /api or /images. For this web application scenario that requires Layer 7 traffic management, Azure Load Balancer is fundamentally inadequate.
- ✓
Azure Application Gateway
Why this is correct
Azure Application Gateway is a Layer 7 web traffic load balancer that provides advanced application-level features, including URL path-based routing, SSL/TLS termination, cookie-based session affinity, and an optional Web Application Firewall (WAF). It allows traffic to be routed to different backend pools based on URL patterns, which directly meets the stated requirement. This makes it the correct choice for regional Azure VM web applications needing path-based routing and SSL offload.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager is a DNS-based traffic routing service that operates at the domain name resolution level, directing clients to an eligible regional endpoint based on routing methods like performance, priority, or geography. It cannot inspect HTTP requests, parse URL paths, or terminate TLS connections because it never sits in the data path between clients and servers. While it can provide global failover and latency-based routing, it does not meet the Layer 7 requirements of URL path routing and SSL termination.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is incorrect because it is a global, edge-based service primarily designed for distributing traffic across multiple Azure regions or hybrid environments. While it provides URL-path-based routing and SSL/TLS termination, which are required, its global nature is not specified as a requirement for this regional Azure VM deployment. It is tempting because it performs these Layer 7 functions, and would be the correct choice for globally distributed web applications needing optimal performance, high availability, and security at the edge.
Go deeper
Related to this question
Learn chapter
Designing Identity Solutions
Key term
Application Gateway Design
Application Gateway Design is the process of planning and configuring a layer 7 load balancer in Azure that routes web traffic based on URL paths, hostnames, or other HTTP rules for secure, scalable, and high-performance application delivery.
About these practice questions
Courseiva writes every AZ-305 question from scratch — 212 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.