Question 508 of 161
AZ-305 Design infrastructure solutions Practice Question
A global e-commerce company deploys its web application on Azure Kubernetes Service (AKS) clusters in multiple Azure regions. They need a single global endpoint for users, with SSL offloading, web application firewall (WAF) protection, and URL path-based routing to the nearest healthy AKS cluster. Which Azure service should they use?
⚠ Common exam trap
Test-takers frequently confuse Azure Traffic Manager (DNS-level) with Azure Front Door (application-layer), overlooking the need for SSL offloading, WAF, and path-based routing that only Front Door provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Front Door
Azure Front Door is the correct choice because it provides a single global endpoint with SSL offloading, WAF protection, and URL path-based routing. It uses Anycast-based routing to direct traffic to the nearest healthy AKS cluster, ensuring low latency and high availability across multiple regions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Front Door
Why this is correct
Azure Front Door is correct because it operates at Layer 7 as a global entry point using Microsoft's edge network. It supports SSL offloading, web application firewall (WAF), and URL path-based routing, and it uses anycast to route users to the nearest healthy backend based on global health probes. This uniquely combines global distribution with HTTP-layer intelligence and security, making it ideal for a globally distributed e-commerce web application.
- ✗
Azure Traffic Manager
Why it's wrong here
Traffic Manager is a DNS-based traffic router that only resolves domain names to endpoint IPs at the DNS level. It cannot terminate SSL, inspect HTTP content, or apply WAF rules, and it lacks URL path-based routing because it never sees the actual traffic. While it can route users globally, it cannot make application-layer decisions or protect the application, so it does not meet the full requirements.
- ✗
Azure Application Gateway
Why it's wrong here
Application Gateway is a regional Layer 7 load balancer that provides SSL offloading, WAF, and URL path-based routing, but its scope is limited to a single Azure region. It can route traffic among backends within that region but cannot distribute or intelligently route users across multiple geographic regions. For global e-commerce scale and redundancy, you need a multi-region front-end, which Application Gateway alone cannot provide.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer is a Layer 4 network load balancer that forwards TCP/UDP traffic without any awareness of HTTP content. It does not perform SSL termination, cannot inspect URLs for path-based routing, and does not integrate a WAF. Additionally, it is a regional service, so it lacks the global anycast-based edge routing that Front Door offers for worldwide traffic distribution.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.