Design infrastructure solutions →mediumMultiple ChoiceObjective-mapped

AZ-305 Design infrastructure solutions Practice Question

A company is deploying a web application on Azure App Service. They need to guarantee that all traffic from the internet goes through a Web Application Firewall (WAF) before reaching the app. The solution must be cost-effective for a single application. Which Azure service should they place in front of the App Service?

⚠ Common exam trap

A common mix-up: candidates confuse Azure Front Door with Application Gateway, assuming Front Door is always the better choice for WAF, but the question's emphasis on cost-effectiveness for a single application points to the regional, lower-cost Application Gateway instead.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Azure Application Gateway with WAF.

Azure Application Gateway with WAF is the correct choice because it provides a regional, layer-7 load balancer with built-in Web Application Firewall capabilities, designed to protect web applications from common exploits and vulnerabilities. For a single application, it is more cost-effective than Azure Front Door, which is a global service with higher minimum costs and additional features not required here. Application Gateway can be deployed directly in front of App Service to inspect and filter all internet traffic before it reaches the app.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Azure Application Gateway with WAF.
Why this is correct
Application Gateway is a regional Layer 7 load balancer that integrates WAF. It can be placed directly in front of App Service to inspect all incoming traffic. This is a cost-effective solution for a single-region application.
✗
Azure Front Door with WAF policy.
Why it's wrong here
Azure Front Door with WAF policy is not cost-effective for a single application, as its global distribution and performance optimisation features are designed for multi-region deployments or load balancing across multiple backend applications. While it provides the required WAF functionality, its architecture and pricing model are optimised for globally distributed services, making it an expensive choice for a single, regional application.
✗
Azure Firewall with application rules.
Why it's wrong here
Azure Firewall is a stateful firewall that can filter traffic based on FQDN (application rules), but it does not include a Web Application Firewall (WAF) to protect against OWASP top 10 vulnerabilities. It is not a substitute for a WAF.
✗
Azure Traffic Manager.
Why it's wrong here
Azure Traffic Manager operates at the DNS layer, not the HTTP/S layer, meaning it only resolves domain names to endpoint IP addresses based on routing methods like priority, performance, or geographic. It never inspects actual HTTP traffic, so it cannot detect or block web attacks such as SQL injection, cross-site scripting, or the OWASP Top 10 vulnerabilities that a WAF is designed to mitigate. While Traffic Manager can distribute traffic across endpoints for high availability and failover, it is purely a DNS-level router with no security filtering capabilities, making it unsuitable for this requirement.

Visual reference

Go deeper

AZ-305 Design infrastructure solutions Practice Question

Why each option matters

Option-by-option breakdown

Related to this question