AZ-305 Design infrastructure solutions Practice Question
A company deploys a web application on multiple Azure VMs in a single region. They need to distribute incoming HTTP and HTTPS traffic across the VMs, offload SSL/TLS termination, and maintain session persistence (sticky sessions) so that all requests from a user session go to the same backend VM. Which Azure load balancing solution should they use?
⚠ Common exam trap
Test-takers frequently confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming that any load balancer can handle SSL termination and sticky sessions, but only Layer 7 solutions like Application Gateway or Front Door provide these features.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway
Azure Application Gateway is a Layer 7 load balancer that can distribute HTTP/HTTPS traffic, offload SSL/TLS termination, and support session persistence via cookie-based affinity (sticky sessions). These capabilities directly match the requirements, making it the correct choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Application Gateway
Why this is correct
Azure Application Gateway is the best fit here because it operates at Layer 7 (HTTP/S) and can route traffic based on URL paths or host headers. More importantly, it performs SSL termination and enforces cookie-based session affinity, ensuring that a client's subsequent requests are consistently directed to the same backend VM. It also offers a Web Application Firewall and integrates tightly with VM scale sets in a regional VNet, making it ideal for a multi-VM web application in a single region.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer is incorrect because it is a Layer 4 (TCP/UDP) service, meaning it cannot inspect HTTP headers or route based on application URLs. It offers no SSL termination capability and only provides session persistence based on source IP hashing (5-tuple/2-tuple affinity), which is not cookie-based and can break when clients come from a shared NAT or proxy. Since the requirement demands HTTP-level SSL offload and cookie-based affinity, this option falls short.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager works at the DNS level by resolving the client's request to one of a set of globally distributed endpoints based on traffic-routing methods and health probes. As a result, it never sees the actual HTTP traffic, so it cannot terminate SSL or set HTTP session cookies. It is designed for multi-region, internet-facing failover and geographic routing, not for regional load balancing among VMs behind a single VNet.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door does indeed provide SSL termination, cookie-based session affinity, and Layer 7 routing, but it is a global, multi-region service that routes traffic over Microsoft's global edge network. It is not a regional load balancer and is not installed inside the VNet—clients share the edge entrypoint, which makes it unnecessary and cost-prohibitive for a single-region deployment. For a workload confined to one region with backends in one VNet, Application Gateway is the targeted and appropriate choice.
Go deeper
Related to this question
Learn chapter
Azure VMware Solution Design
Key term
Application Gateway Design
Application Gateway Design is the process of planning and configuring a layer 7 load balancer in Azure that routes web traffic based on URL paths, hostnames, or other HTTP rules for secure, scalable, and high-performance application delivery.
About these practice questions
One of 795 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.