AZ-305 Design infrastructure solutions Practice Question
A company is deploying a web application that must be accessible from the internet. The application is hosted on Azure virtual machines in a virtual network. The solution must provide SSL termination, web application firewall (WAF) protection, and URL path-based routing (e.g., /api/* to one backend pool, /app/* to another). The web tier must not be directly exposed to the internet. Which Azure load balancing solution should they use?
⚠ Common exam trap
Test-takers frequently confuse Azure Front Door with Application Gateway, but Front Door is designed for global, multi-region scenarios and cannot provide direct VNet integration for a single-region app without exposing backend public IPs, whereas Application Gateway is the correct Layer 7 solution for a single-region VNet deployment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway v2
Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that provides SSL termination, a web application firewall (WAF), and URL path-based routing. It can route traffic to different backend pools based on URL paths (e.g., /api/* and /app/*) while keeping the web tier isolated within the virtual network, as the gateway itself is exposed to the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Application Gateway v2
Why this is correct
Azure Application Gateway v2 is a regional Layer 7 reverse proxy that performs SSL termination, web application firewall (WAF) inspection, and URL path-based or multi-site routing. It can be configured with a public front-end IP and a backend pool containing VMs with only private IPs, making it ideal for protecting an internet-facing web tier. The v2 SKU adds auto-scaling and zone redundancy, with the WAF policy enforcing OWASP rule sets at the HTTP edge.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door operates at the global edge and is intended for multi-region, internet-facing applications; it routes HTTP(S) requests to backends that must be publicly reachable or attached via Private Link. Front Door cannot directly forward traffic to a VM that only has a private IP without Private Link because the global edge needs a routable endpoint. While Front Door also offers WAF and TLS offload, its global anycast model and backend reachability constraints make it unsuitable as a regional perimeter for a single web tier using private-only VMs.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer works at Layer 4 and only forwards TCP/UDP packets based on hashing of source IP and port, without inspecting HTTP payloads. As a result, it cannot terminate SSL, filter on URL paths, or host a WAF, which are required capabilities for an internet-facing web application with application-level protection. It simply passes encrypted traffic unchanged to the VM, leaving TLS and path routing to the application itself and offering no web-specific security features.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager is a DNS-based traffic director that returns a client-friendly IP from a set of endpoints in its DNS responses; it does not proxy or rewrite any traffic. Since it operates purely at the DNS level, it cannot terminate SSL, apply WAF policies, or route based on a URL path — the client connects directly to the VM IP that the DNS A record resolves to. Missing these Layer 7 capabilities means Traffic Manager cannot satisfy the requirement to securely route and filter internet-facing HTTP traffic to private backend VMs.
Go deeper
Related to this question
Learn chapter
Designing Azure Storage Solutions
Key term
Application Gateway Design
Application Gateway Design is the process of planning and configuring a layer 7 load balancer in Azure that routes web traffic based on URL paths, hostnames, or other HTTP rules for secure, scalable, and high-performance application delivery.
About these practice questions
Courseiva writes every AZ-305 question from scratch — 204 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.