AZ-305 Design infrastructure solutions Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Azure Front Door

  Why this is correct

  Azure Front Door is a global application delivery controller that operates at Layer 7, using Anycast to terminate connections at the nearest point of presence. It directly satisfies the multi-region AKS requirement by performing SSL offloading, applying a web application firewall, and routing requests to different AKS clusters based on URL paths. Its global health probes and failover are distinct from DNS-based or regional approaches, making it the only listed service that can steer user traffic across the globe while preserving HTTP semantics.

• ✗

  Azure Application Gateway

  Why it's wrong here

  Azure Application Gateway is a regional Layer 7 load balancer, so it can only balance traffic inside a single Azure region and cannot direct users to the healthiest endpoint in another region or continent. It does include WAF and URL path-based routing, but those capabilities are scoped to the gateway's own region, meaning each region would need its own separate gateway, introducing per-region management and DNS complexity. Because the company's requirement is a global AKS deployment, a single Application Gateway would fail to provide cross-region failover or latency-based routing.

• ✗

  Azure Traffic Manager

  Why it's wrong here

  Azure Traffic Manager operates at the DNS level, answering a client's DNS query with one of the configured endpoints based on a routing method such as priority, weighted, or performance. It cannot terminate SSL, cannot inspect URL paths, and does not provide a WAF, so it is fundamentally incapable of making application-layer decisions or offloading certificate management to the edge. While it can route traffic globally, its reliance on DNS TTL and client caching makes it slower to react to endpoint failures, and it has no concept of path-based routing.

• ✗

  Azure Load Balancer

  Why it's wrong here

  Azure Load Balancer is a Layer 4 construct that forwards raw TCP/UDP packets to backends based on five-tuple hashing, never looking at HTTP headers or URL paths. It is always scoped to the region where it is deployed and offers no SSL offloading, no WAF integration, and no content-based routing, making it unsuitable for a microservices gateway that needs to inspect requests. Even with multiple regional load balancers, they would not provide a single global control plane or route users to a different region based on latency.

Go deeper

Related to this question