AZ-305 Design infrastructure solutions Practice Question
A company deploys a web application on multiple Azure VMs. They need to distribute incoming HTTP traffic across the VMs, offload SSL/TLS termination, and maintain session persistence (sticky sessions) so that all requests from a user session go to the same backend VM. Which Azure load balancing solution should they use?
⚠ Common exam trap
Many exam-takers confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), forgetting that SSL termination and cookie-based sticky sessions require Layer 7 capabilities, not just Layer 4 load balancing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway
Azure Application Gateway is a Layer 7 load balancer that can route HTTP/HTTPS traffic, offload SSL/TLS termination, and support session persistence using cookie-based affinity. This makes it the correct choice for distributing incoming HTTP traffic across multiple VMs while maintaining sticky sessions and handling SSL termination at the gateway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Application Gateway
Why this is correct
Azure Application Gateway is a dedicated layer-7 (HTTP/HTTPS) load balancer that offers SSL offloading by terminating client SSL connections and re-encrypting traffic to backends if needed. It provides cookie-based session affinity, which ensures a user's requests are consistently routed to the same backend VM—a critical requirement for stateful web applications. Additionally, it supports URL path-based routing and an integrated Web Application Firewall, making it the correct choice for a web application deployed on multiple VMs within a single Azure region.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer operates at OSI layer 4 and only forwards TCP/UDP traffic based on IP address, port, and protocol, without inspecting the HTTP payload. It cannot offload SSL because it lacks the ability to decrypt application-layer traffic, and while it supports source IP affinity, this is not cookie-based session affinity—it relies on hashing client IPs and can break for users behind NAT or large proxy servers. Therefore, it fails to meet the web application's requirement for application-aware routing and sticky sessions.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager is a DNS-based routing service that resolves user requests to the appropriate endpoint based on domains, regions, or performance metrics, but it does not handle actual network traffic after DNS resolution. It cannot inspect HTTP content, so it cannot perform SSL offloading or maintain cookie-based session affinity at the application layer. Its purpose is global load balancing across multiple regions, not distributing traffic among VMs in a single regional deployment—so it is the wrong tool for this scenario.
- ✗
Azure Front Door
Why it's wrong here
Front Door is a global layer-7 load balancer with SSL offload and session affinity, but it is designed for global multi-region deployments and includes additional features like WAF. Application Gateway is the correct choice for a region-specific load balancer.
Go deeper
Related to this question
Learn chapter
Designing Azure Storage Solutions
Key term
Application Gateway Design
Application Gateway Design is the process of planning and configuring a layer 7 load balancer in Azure that routes web traffic based on URL paths, hostnames, or other HTTP rules for secure, scalable, and high-performance application delivery.
About these practice questions
Courseiva writes every AZ-305 question from scratch — 212 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.