How should I use these Route 53 Failover practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Route 53 Failover questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Route 53 Failover domain.

AZ-305 · topic practice

Route 53 Failover practice questions

Practise Microsoft Azure Solutions Architect Expert AZ-305 Route 53 Failover practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

9 questionsDomain: Route 53 Failover

Practice 10 questions Browse domain →

What the exam tests

What to know about Route 53 Failover

Route 53 Failover questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Route 53 Failover exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Route 53 Failover questions

9 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full VPN explanation →

You are designing a connectivity solution for a hybrid network. The company has an on-premises network connected to an Azure virtual network via ExpressRoute. They also have a site-to-site VPN to the same Azure virtual network as a backup. When the ExpressRoute connection fails, traffic should automatically fail over to the VPN. How should you configure the routes to ensure automatic failover?

Trap 1: Configure Azure Traffic Manager with a priority routing method to…

Azure Traffic Manager operates at the DNS layer, resolving domain names to endpoints, and does not influence the underlying IP routing or BGP path selection between ExpressRoute and a VPN gateway. A priority routing method can only control which front-end endpoint receives new DNS queries, not which physical WAN link carries packet traffic during an ExpressRoute outage. Therefore, Traffic Manager cannot serve as a network-level failover mechanism for hybrid connectivity, and the correct control is the BGP metric on the gateway connections.

Trap 2: Set the BGP metrics (local preference) on the ExpressRoute…

Setting the BGP metric (or local preference) higher on the ExpressRoute connection is counterproductive because, for the BGP MED attribute, a lower value is preferred during path selection. If the ExpressRoute route carries a higher MED than the VPN route, Azure will select the VPN as the primary path, meaning normal traffic is sent over VPN even when ExpressRoute is healthy. The correct configuration is to keep the ExpressRoute metric lower; raising it would invert the intended priority and cause suboptimal routing or failover behavior.

Trap 3: Configure Azure Route Server to propagate routes with a lower…

Azure Route Server is used to exchange routes between Azure Virtual Network and network virtual appliances (NVAs), not to configure the BGP metrics of a VPN gateway or ExpressRoute circuit. Even if Route Server propagated a lower metric for the VPN routes, that would cause Azure to prefer the VPN over ExpressRoute, defeating the goal of using ExpressRoute as the primary path. Route Server does not participate in the gateway's selection between ExpressRoute and VPN, and it is unnecessary for this scenario; BGP metrics are set directly on the connections themselves.

Study all Route 53 Failover common traps →

A
Configure Azure Traffic Manager with a priority routing method to direct traffic to ExpressRoute first.
Why it fails: Azure Traffic Manager operates at the DNS layer, resolving domain names to endpoints, and does not influence the underlying IP routing or BGP path selection between ExpressRoute and a VPN gateway. A priority routing method can only control which front-end endpoint receives new DNS queries, not which physical WAN link carries packet traffic during an ExpressRoute outage. Therefore, Traffic Manager cannot serve as a network-level failover mechanism for hybrid connectivity, and the correct control is the BGP metric on the gateway connections.
B
Ensure the ExpressRoute connection has a lower BGP metric than the VPN connection; Azure automatically prefers lower metric.
ExpressRoute and VPN gateway BGP peering allow Azure to choose between the two paths by comparing BGP attributes; a lower BGP metric (such as MED) on the ExpressRoute connection makes it the preferred route because Azure selects the path with the lowest metric. When the ExpressRoute circuit fails, its route is withdrawn and the VPN route with the higher metric becomes the only available path, enabling automatic failover. This is the standard, supported coexistence design for resilient hybrid networking, and no additional traffic-management or routing services are required.
C
Set the BGP metrics (local preference) on the ExpressRoute connection to be higher than the VPN connection.
Why it fails: Setting the BGP metric (or local preference) higher on the ExpressRoute connection is counterproductive because, for the BGP MED attribute, a lower value is preferred during path selection. If the ExpressRoute route carries a higher MED than the VPN route, Azure will select the VPN as the primary path, meaning normal traffic is sent over VPN even when ExpressRoute is healthy. The correct configuration is to keep the ExpressRoute metric lower; raising it would invert the intended priority and cause suboptimal routing or failover behavior.
D
Configure Azure Route Server to propagate routes with a lower metric for the VPN connection.
Why it fails: Azure Route Server is used to exchange routes between Azure Virtual Network and network virtual appliances (NVAs), not to configure the BGP metrics of a VPN gateway or ExpressRoute circuit. Even if Route Server propagated a lower metric for the VPN routes, that would cause Azure to prefer the VPN over ExpressRoute, defeating the goal of using ExpressRoute as the primary path. Route Server does not participate in the gateway's selection between ExpressRoute and VPN, and it is unnecessary for this scenario; BGP metrics are set directly on the connections themselves.

Full breakdown with real-world context →

Question 2mediummultiple choice

Review the full routing breakdown →

A company has two on-premises data centers and an Azure subscription. They need to connect each data center to Azure with a private, high-bandwidth, and reliable connection. They also want a low-cost backup connection for each data center in case the primary connection fails. Which combination of connectivity options should they recommend?

Trap 1: B

This design is incorrect because site-to-site VPNs traverse the public internet and offer only best-effort throughput, which is unlikely to meet the high-bandwidth and low-latency requirements of enterprise workloads; conversely, using ExpressRoute as a backup is financially impractical because you would be paying for dedicated circuits that remain idle most of the time. While VPN can be a backup, it should not be the primary for critical workloads that need consistent performance and a private network path. Therefore, Option B places the higher-performing, more reliable service as the backup rather than the primary, inverting the correct architecture.

Trap 2: C

This option is flawed because a single Azure VPN Gateway, even in active-passive mode, is primarily a VPN endpoint and does not provide the dedicated private connectivity, consistent throughput, or lower latency of ExpressRoute. Additionally, relying on one gateway instance to serve connections from both data centers introduces a single point of failure for the entire hybrid network—if that gateway fails or is patched, both sites lose connectivity. This would not satisfy a requirement for high reliability from two independent data centers, and the active-passive configuration only protects against certain gateway-level failures, not the lack of a dedicated WAN link.

Trap 3: D

This option is technically impractical because a single ExpressRoute circuit with a single VPN connection shared across two data centers creates a single point of failure and cannot provide independent path redundancy for each location. Each data center needs its own dedicated primary and backup circuit to launch a true site-to-site-to-Azure redundancy; sharing one circuit would require a complex and fragile network topology, likely with insufficient bandwidth for aggregated traffic, and any outage or maintenance on the shared circuit would simultaneously affect both data centers. This design does not meet the core objectives of high availability, fault isolation, and predictable performance across geographically separate sites.

Study all Route 53 Failover common traps →

A
A
This is the correct design because each data center establishes its own dedicated ExpressRoute circuit as the primary path, ensuring predictable, high-bandwidth, and low-latency connectivity to Azure with an SLA-backed private link. The site-to-site VPN for each data center acts as an IPsec-based backup over the internet, providing a cost-effective failover path that automatically kicks in if the ExpressRoute circuit fails. This active/passive redundancy model is a best practice for hybrid networking, as it avoids a single point of failure while keeping operational costs reasonable.
B
B
Why it fails: This design is incorrect because site-to-site VPNs traverse the public internet and offer only best-effort throughput, which is unlikely to meet the high-bandwidth and low-latency requirements of enterprise workloads; conversely, using ExpressRoute as a backup is financially impractical because you would be paying for dedicated circuits that remain idle most of the time. While VPN can be a backup, it should not be the primary for critical workloads that need consistent performance and a private network path. Therefore, Option B places the higher-performing, more reliable service as the backup rather than the primary, inverting the correct architecture.
C
C
Why it fails: This option is flawed because a single Azure VPN Gateway, even in active-passive mode, is primarily a VPN endpoint and does not provide the dedicated private connectivity, consistent throughput, or lower latency of ExpressRoute. Additionally, relying on one gateway instance to serve connections from both data centers introduces a single point of failure for the entire hybrid network—if that gateway fails or is patched, both sites lose connectivity. This would not satisfy a requirement for high reliability from two independent data centers, and the active-passive configuration only protects against certain gateway-level failures, not the lack of a dedicated WAN link.
D
D
Why it fails: This option is technically impractical because a single ExpressRoute circuit with a single VPN connection shared across two data centers creates a single point of failure and cannot provide independent path redundancy for each location. Each data center needs its own dedicated primary and backup circuit to launch a true site-to-site-to-Azure redundancy; sharing one circuit would require a complex and fragile network topology, likely with insufficient bandwidth for aggregated traffic, and any outage or maintenance on the shared circuit would simultaneously affect both data centers. This design does not meet the core objectives of high availability, fault isolation, and predictable performance across geographically separate sites.

Full breakdown with real-world context →

Question 3hardmultiple choice

Review the full routing breakdown →

You are designing a network topology for a global e-commerce company that operates multiple web applications. The company has three main offices (New York, London, Tokyo) connected via ExpressRoute to Azure. Users access the applications through a public endpoint. The company requires that traffic be routed to the nearest healthy application instance based on geographic location, and that the solution provide automatic failover if an entire region goes down. Additionally, the company wants to protect against DDoS attacks at the network layer. You need to recommend a solution that meets these requirements while minimizing cost. What should you include in the design?

Trap 1: Deploy Azure Firewall in each region and use Public IP prefix for…

Deploying Azure Firewall in each region with a Public IP prefix is flawed because Azure Firewall is a regional, stateful security service that inspects network traffic but does not perform global load balancing or geographic routing. While a Public IP prefix ensures predictable outbound egress IPs, it does not solve inbound traffic distribution across regions. This architecture would still require an external DNS or global load balancer to route users, and it lacks the anycast edge capabilities and integrated DDoS protection that a global entry point like Front Door provides.

Trap 2: Deploy Azure Application Gateway v2 with WAF in each region and…

Azure Application Gateway v2 with WAF is a regional Layer 7 load balancer, so even if you deploy one in each region, you must rely on separately configured DNS records or an additional global traffic manager to send users to the correct regional gateway. It does not offer anycast or a single global DNS name for the entire topology, and its geographic routing capabilities are limited to routing within a virtual network, not across regions. Azure DDoS Standard protection is also scoped to a specific public IP in a VNet, not global, so this option fails to provide a unified global edge with DDoS protection at the internet boundary.

Trap 3: Deploy Azure Traffic Manager with geographic routing and Azure DDoS…

Azure Traffic Manager is a DNS-based global load balancer that does support geographic routing, but it lacks native DDoS protection because it only resolves DNS names and does not proxy traffic—the actual payload still flows directly to your origin IPs, which remain exposed to L3/L4 DDoS attacks. Additionally, because routing is DNS-dependent, failover is delayed by TTL caching and health probe intervals, and geographic routing policies are applied at DNS resolution time, not per-request, making it less responsive and less secure. This option does not meet the requirement for a secure, globally load-balanced edge with built-in DDoS mitigation, which Front Door provides.

Study all Route 53 Failover common traps →

A
Deploy Azure Front Door with geographic routing and enable DDoS protection.
Azure Front Door is the correct choice for a global e-commerce topology because it operates as a single anycast global endpoint, automatically routing users to the nearest region via its distributed edge network. It natively supports geographic routing to enforce data residency or direct customer traffic based on country/region, and it integrates with Azure WAF and Azure DDoS Standard, providing both L7 and L3/L4 protection at the edge. This combination gives you global load balancing, low-latency access, and comprehensive security without needing to manage per-region ingress gateways.
B
Deploy Azure Firewall in each region and use Public IP prefix for egress.
Why it fails: Deploying Azure Firewall in each region with a Public IP prefix is flawed because Azure Firewall is a regional, stateful security service that inspects network traffic but does not perform global load balancing or geographic routing. While a Public IP prefix ensures predictable outbound egress IPs, it does not solve inbound traffic distribution across regions. This architecture would still require an external DNS or global load balancer to route users, and it lacks the anycast edge capabilities and integrated DDoS protection that a global entry point like Front Door provides.
C
Deploy Azure Application Gateway v2 with WAF in each region and Azure DDoS Standard protection.
Why it fails: Azure Application Gateway v2 with WAF is a regional Layer 7 load balancer, so even if you deploy one in each region, you must rely on separately configured DNS records or an additional global traffic manager to send users to the correct regional gateway. It does not offer anycast or a single global DNS name for the entire topology, and its geographic routing capabilities are limited to routing within a virtual network, not across regions. Azure DDoS Standard protection is also scoped to a specific public IP in a VNet, not global, so this option fails to provide a unified global edge with DDoS protection at the internet boundary.
D
Deploy Azure Traffic Manager with geographic routing and Azure DDoS Standard protection.
Why it fails: Azure Traffic Manager is a DNS-based global load balancer that does support geographic routing, but it lacks native DDoS protection because it only resolves DNS names and does not proxy traffic—the actual payload still flows directly to your origin IPs, which remain exposed to L3/L4 DDoS attacks. Additionally, because routing is DNS-dependent, failover is delayed by TTL caching and health probe intervals, and geographic routing policies are applied at DNS resolution time, not per-request, making it less responsive and less secure. This option does not meet the requirement for a secure, globally load-balanced edge with built-in DDoS mitigation, which Front Door provides.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full DNS explanation →

A company plans to deploy multiple virtual machines (VMs) across two Azure regions for high availability. The VMs will host a stateless web application that must be accessible via a single DNS endpoint. The solution must automatically route traffic to the nearest region with available capacity and provide failover if a region becomes unhealthy. Which Azure service should they use to meet these requirements?

Trap 1: Azure Front Door

Azure Front Door is tempting as it provides a single global DNS endpoint, automatically routes traffic to the nearest healthy region based on latency, and offers failover for high availability, which aligns with several requirements for a global web application. However, it fails to meet the specific requirement for routing traffic based on "available capacity". Front Door primarily uses latency-based routing and health probes, not dynamic load-based distribution across regions to account for current capacity constraints, which is a key distinction for this scenario.

Trap 2: Azure Load Balancer

Azure Load Balancer is a regional, layer-4 network load balancer that distributes traffic within a single Azure region and a single virtual network. It cannot route or redirect traffic across multiple regions because it has no DNS-based or global endpoint capability, and its health probes only monitor VMs in its own backend pool. Therefore, it fails to provide the cross-region capacity-based routing required for a multi-region VM deployment.

Trap 3: Azure Application Gateway

Azure Application Gateway operates at Layer 7 (HTTP/HTTPS) and is deployed within one region, providing SSL termination, path-based routing, and WAF capabilities for regional web traffic. While it can perform sophisticated request routing based on URL and host headers, it lacks a global DNS-based traffic management layer and cannot direct users to the nearest or most available regional deployment. Its backend pools are confined to a single region, so it cannot satisfy the requirement for routing across multiple regional VM deployments based on available capacity.

Study all Route 53 Failover common traps →

A
Azure Traffic Manager
Azure Traffic Manager is a DNS-based global load balancer that routes incoming DNS requests to the most appropriate regional endpoint based on routing methods such as performance, geographic, weighted, or priority. It continuously monitors endpoint health and can automatically redirect traffic away from failed or overloaded regions, ensuring high availability and capacity-aware distribution across multiple VMs in different regions.
B
Azure Front Door
Why it fails: Azure Front Door is tempting as it provides a single global DNS endpoint, automatically routes traffic to the nearest healthy region based on latency, and offers failover for high availability, which aligns with several requirements for a global web application. However, it fails to meet the specific requirement for routing traffic based on "available capacity". Front Door primarily uses latency-based routing and health probes, not dynamic load-based distribution across regions to account for current capacity constraints, which is a key distinction for this scenario.
C
Azure Load Balancer
Why it fails: Azure Load Balancer is a regional, layer-4 network load balancer that distributes traffic within a single Azure region and a single virtual network. It cannot route or redirect traffic across multiple regions because it has no DNS-based or global endpoint capability, and its health probes only monitor VMs in its own backend pool. Therefore, it fails to provide the cross-region capacity-based routing required for a multi-region VM deployment.
D
Azure Application Gateway
Why it fails: Azure Application Gateway operates at Layer 7 (HTTP/HTTPS) and is deployed within one region, providing SSL termination, path-based routing, and WAF capabilities for regional web traffic. While it can perform sophisticated request routing based on URL and host headers, it lacks a global DNS-based traffic management layer and cannot direct users to the nearest or most available regional deployment. Its backend pools are confined to a single region, so it cannot satisfy the requirement for routing across multiple regional VM deployments based on available capacity.

Full breakdown with real-world context →

Question 5mediummulti select

Review the full routing breakdown →

A company is designing a highly available architecture for a web application on Azure VMs. The solution must protect against both planned and unplanned downtime and provide automatic failover. Which TWO Azure services should the company use together? (Choose two.)

Trap 1: Azure Site Recovery

Azure Site Recovery is a disaster recovery service that replicates Azure VMs from a primary region to a secondary region and orchestrates failover during a full regional outage. Its purpose is to protect against region-wide loss, not to provide redundancy within the same region; failover involves recovery time objectives and requires a secondary site. Because this question concerns resiliency to a datacenter-level fault within one region, Site Recovery is the wrong choice.

Trap 2: Azure Traffic Manager

Azure Traffic Manager operates at the DNS level, directing clients to the nearest or healthiest regional endpoint. It cannot detect the health of individual VMs or route traffic between availability zones within a single region; it only makes a coarse routing decision once per DNS lookup. Therefore, it does not contribute to intra-region high availability and would only be relevant for cross-region failover or geographic load distribution.

Trap 3: Azure Application Gateway

Application Gateway is a Layer 7 web traffic load balancer that offers SSL termination, URL-based routing, and a Web Application Firewall, and it can be deployed as zone-redundant. However, for a general high-availability architecture of VM workloads, it is an optional enhancement, not the core HA mechanism; the required redundancy is delivered by Availability Zones and a Layer 4 Load Balancer. Overusing it for simple TCP/UDP health checks adds cost and complexity without improving fault tolerance, so it is not one of the two best choices here.

Study all Route 53 Failover common traps →

A
Azure Availability Zones
Azure Availability Zones are physically separate datacenters within the same Azure region, each with independent power, cooling, and networking. By placing VM replicas across multiple zones, you ensure that a failure of one entire datacenter does not affect all instances, achieving intra-region high availability. This is the foundational building block for many HA architectures and carries a 99.99% VM SLA when two or more instances are deployed across zones.
B
Azure Site Recovery
Why it fails: Azure Site Recovery is a disaster recovery service that replicates Azure VMs from a primary region to a secondary region and orchestrates failover during a full regional outage. Its purpose is to protect against region-wide loss, not to provide redundancy within the same region; failover involves recovery time objectives and requires a secondary site. Because this question concerns resiliency to a datacenter-level fault within one region, Site Recovery is the wrong choice.
C
Azure Traffic Manager
Why it fails: Azure Traffic Manager operates at the DNS level, directing clients to the nearest or healthiest regional endpoint. It cannot detect the health of individual VMs or route traffic between availability zones within a single region; it only makes a coarse routing decision once per DNS lookup. Therefore, it does not contribute to intra-region high availability and would only be relevant for cross-region failover or geographic load distribution.
D
Azure Load Balancer
Standard Azure Load Balancer provides Layer 4 load balancing and supports zone-redundant frontends, which can distribute inbound TCP/UDP traffic across virtual machines in different availability zones. It continuously probes backend pool health and removes failed instances, ensuring traffic is only sent to healthy VMs. This makes it a fundamental service for building high availability inside a region, complementing Availability Zones.
E
Azure Application Gateway
Why it fails: Application Gateway is a Layer 7 web traffic load balancer that offers SSL termination, URL-based routing, and a Web Application Firewall, and it can be deployed as zone-redundant. However, for a general high-availability architecture of VM workloads, it is an optional enhancement, not the core HA mechanism; the required redundancy is delivered by Availability Zones and a Layer 4 Load Balancer. Overusing it for simple TCP/UDP health checks adds cost and complexity without improving fault tolerance, so it is not one of the two best choices here.

Full breakdown with real-world context →

Question 6easymultiple choice

Review the full routing breakdown →

You are designing a high-availability solution for a stateless web application running on Azure VMs. The solution must provide automatic failover to another region in the event of a regional outage. Which Azure service should you use to distribute traffic across regions?

Trap 1: Azure Application Gateway

Azure Application Gateway operates at Layer 7 as a regional application delivery controller, handling HTTP(S) routing, SSL offloading, and WAF within a single Azure region. It cannot automatically shift traffic between regions because it has no global endpoint or health monitoring across distant deployments, so a regional outage would take the gateway itself down along with the backend. Even with multiple instances in an availability zone, you would need a separate global front-end to drive cross-region failover.

Trap 2: Azure Load Balancer

Azure Load Balancer is a Layer 4 regional service that distributes TCP/UDP traffic to healthy VMs or VM scale sets inside a single virtual network. It does not terminate HTTP or make routing decisions based on URL paths, and it has no concept of a primary or secondary region; its health probes only test local backend instances. Because it is bound to one region's data path, it cannot provide the global anycast or DNS-based failover needed for a stateless web app spread across regions.

Trap 3: Azure Traffic Manager

Azure Traffic Manager is a DNS-based traffic router that can direct users to different regional endpoints, and it does perform health checks and automatic failover. However, it only resolves a DNS name to an IP address; it does not sit in the data path, so it cannot provide SSL termination, URL rewriting, or a WAF. Clients and intermediate DNS resolvers may cache the DNS records, causing slower failover and less precise control than Front Door, making it a simpler but less feature-rich option for a modern web application.

Study all Route 53 Failover common traps →

A
Azure Application Gateway
Why it fails: Azure Application Gateway operates at Layer 7 as a regional application delivery controller, handling HTTP(S) routing, SSL offloading, and WAF within a single Azure region. It cannot automatically shift traffic between regions because it has no global endpoint or health monitoring across distant deployments, so a regional outage would take the gateway itself down along with the backend. Even with multiple instances in an availability zone, you would need a separate global front-end to drive cross-region failover.
B
Azure Load Balancer
Why it fails: Azure Load Balancer is a Layer 4 regional service that distributes TCP/UDP traffic to healthy VMs or VM scale sets inside a single virtual network. It does not terminate HTTP or make routing decisions based on URL paths, and it has no concept of a primary or secondary region; its health probes only test local backend instances. Because it is bound to one region's data path, it cannot provide the global anycast or DNS-based failover needed for a stateless web app spread across regions.
C
Azure Front Door
Azure Front Door is a global, layer 7 service that uses anycast to route HTTP(S) traffic to the nearest healthy origin, with automatic failover if a backend region becomes unhealthy. It supports SSL termination, path-based routing, session affinity, and a built-in WAF, making it well-suited for stateless web applications that require both low-latency global access and resiliency. Front Door continuously probes health endpoints in each region and instantly shifts traffic to the next-capable origin without relying on DNS caching clients.
D
Azure Traffic Manager
Why it fails: Azure Traffic Manager is a DNS-based traffic router that can direct users to different regional endpoints, and it does perform health checks and automatic failover. However, it only resolves a DNS name to an IP address; it does not sit in the data path, so it cannot provide SSL termination, URL rewriting, or a WAF. Clients and intermediate DNS resolvers may cache the DNS records, causing slower failover and less precise control than Front Door, making it a simpler but less feature-rich option for a modern web application.

Full breakdown with real-world context →

Question 7mediummulti select

Review the full routing breakdown →

Which TWO of the following Azure services can be used to enable automatic failover of a web application across Azure regions?

Trap 1: Azure DNS

Azure DNS is a global name resolution service that hosts your domain's DNS records, but it lacks any health-probing or traffic-routing logic. It simply serves the records you configure—such as an A record pointing to a public IP—and does not automatically alter that response if a regional endpoint becomes unhealthy. To achieve health-based failover, you would need a DNS-based traffic manager or a global anycast service, not Azure DNS itself.

Trap 2: Azure Load Balancer

Azure Load Balancer (standard) is a Layer 4 load balancer that operates within a single Azure region and a single virtual network, distributing traffic to healthy VMs in that region. It cannot route traffic across regions, so if an entire region fails, the Load Balancer has no path to a backup region. Cross-region failover requires a globally oriented service such as Azure Front Door or Azure Traffic Manager.

Trap 3: Azure Application Gateway

Azure Application Gateway is a regional Layer 7 load balancer that handles HTTP(S) traffic within a single Azure region using features like URL path–based routing, session affinity, and a web application firewall. It only balances among backends in that same region, so it cannot detect an entire region's outage and send traffic to a failover region. For region-level resilience you must combine it with a global traffic router such as Traffic Manager or Front Door.

Study all Route 53 Failover common traps →

A
Azure DNS
Why it fails: Azure DNS is a global name resolution service that hosts your domain's DNS records, but it lacks any health-probing or traffic-routing logic. It simply serves the records you configure—such as an A record pointing to a public IP—and does not automatically alter that response if a regional endpoint becomes unhealthy. To achieve health-based failover, you would need a DNS-based traffic manager or a global anycast service, not Azure DNS itself.
B
Azure Load Balancer
Why it fails: Azure Load Balancer (standard) is a Layer 4 load balancer that operates within a single Azure region and a single virtual network, distributing traffic to healthy VMs in that region. It cannot route traffic across regions, so if an entire region fails, the Load Balancer has no path to a backup region. Cross-region failover requires a globally oriented service such as Azure Front Door or Azure Traffic Manager.
C
Azure Front Door
Azure Front Door is a global Layer 7 anycast service that continuously health-checks each backend or origin and uses that status to steer traffic to the nearest healthy region. When a region fails, Front Door quickly removes that origin from its active routing set, causing users to be redirected to another region with minimal disruption. It also provides TLS termination, URL-based routing, and a web application firewall, making it a robust choice for global web applications.
D
Azure Traffic Manager
Azure Traffic Manager is a DNS-based traffic router that responds to DNS queries by selecting a regional endpoint based on configured routing methods (priority, performance, geography, weighted) and live endpoint health checks. When a health probe fails for a region, Traffic Manager stops returning that region's DNS answer and instead returns another healthy regional endpoint, allowing automatic failover. Because it relies on DNS, failover speed is dependent on the time-to-live (TTL) of the client's cached records.
E
Azure Application Gateway
Why it fails: Azure Application Gateway is a regional Layer 7 load balancer that handles HTTP(S) traffic within a single Azure region using features like URL path–based routing, session affinity, and a web application firewall. It only balances among backends in that same region, so it cannot detect an entire region's outage and send traffic to a failover region. For region-level resilience you must combine it with a global traffic router such as Traffic Manager or Front Door.

Full breakdown with real-world context →

Question 8hardmultiple choice

Review the full routing breakdown →

Contoso Ltd. is a global e-commerce company running its online store on Azure. The application consists of: - Frontend: Azure App Service (Windows) in West US. - Backend: Azure Kubernetes Service (AKS) cluster in West US. - Database: Azure SQL Database (General Purpose, S2) in West US. - Cache: Azure Cache for Redis (Standard C1) in West US. - Storage: Azure Blob Storage (LRS) for product images.

Business continuity requirements: - RPO: 5 minutes for the database. - RTO: 1 hour for the entire application. - The solution must survive a complete West US region outage. - Budget is limited; minimize additional costs.

What should you recommend as the primary DR strategy?

Trap 1: Use Azure Backup for the database with 5-minute log backup…

Azure Backup restores data after an outage; it does not provide the automated regional failover and traffic redirection the 1-hour RTO demands, since recovery is manual and rebuild times exceed it. It is tempting because backup is the cheapest data-protection mechanism, and it would suit scenarios where only data durability matters and downtime is tolerable.

Trap 2: Deploy the entire application across two Azure Availability Zones…

Availability Zones protect against datacentre failure within West US, but a complete regional outage takes down every zone, so the RTO and survival requirement are unmet. It is tempting because zone redundancy is the low-cost, low-overhead resilience pattern, and would be correct when the requirement is zonal rather than regional failure.

Trap 3: Use Azure Site Recovery to replicate all VMs (including AKS nodes)…

Azure Site Recovery replicates VMs, but AKS nodes are managed and unsupported for ASR, and the limited budget cannot absorb a full standby region plus Redis geo-replication. It is tempting because ASR is the standard VM-level DR tool, and would be correct for IaaS workloads rather than managed PaaS services.

Study all Route 53 Failover common traps →

A
Deploy a secondary region (East US) with a passive AKS cluster (minimal node count), a standby App Service plan (same tier), and a secondary Azure SQL Database in an auto-failover group. Use Azure Traffic Manager for frontend and configure Azure Cache for Redis with geo-replication. For Blob Storage, enable geo-redundant storage (GRS).
A passive secondary region with auto-failover groups meets the 5-minute database RPO and 1-hour RTO, while Traffic Manager, Redis geo-replication and GRS cover the remaining tiers. Minimal AKS nodes and a standby plan keep costs low, satisfying the limited-budget constraint.
B
Use Azure Backup for the database with 5-minute log backup frequency. For the app, use Azure App Service backup with frequency to a secondary region. For AKS, back up persistent volumes using Azure Backup. Restore everything in a secondary region during disaster.
Why it fails: Azure Backup restores data after an outage; it does not provide the automated regional failover and traffic redirection the 1-hour RTO demands, since recovery is manual and rebuild times exceed it. It is tempting because backup is the cheapest data-protection mechanism, and it would suit scenarios where only data durability matters and downtime is tolerable.
C
Deploy the entire application across two Azure Availability Zones within West US. Use zone-redundant storage for blobs, zone-redundant App Service plan, and zone-redundant AKS. For SQL Database, use a zone-redundant configuration. For Redis, use Enterprise tier with zone redundancy.
Why it fails: Availability Zones protect against datacentre failure within West US, but a complete regional outage takes down every zone, so the RTO and survival requirement are unmet. It is tempting because zone redundancy is the low-cost, low-overhead resilience pattern, and would be correct when the requirement is zonal rather than regional failure.
D
Use Azure Site Recovery to replicate all VMs (including AKS nodes) to a secondary region. For the database, use Azure SQL Database active geo-replication. For Azure Cache for Redis, replicate data via geo-replication. Use Azure Traffic Manager for frontend traffic routing.
Why it fails: Azure Site Recovery replicates VMs, but AKS nodes are managed and unsupported for ASR, and the limited budget cannot absorb a full standby region plus Redis geo-replication. It is tempting because ASR is the standard VM-level DR tool, and would be correct for IaaS workloads rather than managed PaaS services.

Full breakdown with real-world context →

Question 9hardmultiple choice

Review the full routing breakdown →

A company uses Azure Cosmos DB with a single write region. They need to ensure business continuity with an RPO of 5 seconds and RTO of 1 minute in case of a regional outage. What configuration should they use?

Trap 1: Enable automatic failover from a single write region to a read…

With a single write region, enabling automatic failover designates one read-only region to become the new write region if the primary fails, but replication between regions is asynchronous. Therefore the promoted region can be up to 15 minutes behind, meaning committed writes may be lost, so the effective RPO is not zero. The failover process also involves detection, health probes, and DNS update, which adds RTO delay; this option addresses availability but not the requirement of zero data loss.

Trap 2: Deploy Cosmos DB in an availability zone-enabled region

Availability-zone-enabled Cosmos DB replicates data synchronously across multiple zones within a single Azure region, protecting against rack or datacenter failures but providing no cross-region redundancy. Because all zones are part of the same regional footprint, a regional outage takes down the entire deployment, making failover impossible. This option is about high availability within a region, not the cross-region disaster recovery and failover behavior the scenario requires.

Trap 3: Use manual failover to a secondary read region

A manual failover to a secondary read region requires an operator to trigger the promotion after a failure is detected, and the process includes waiting for the read region to catch up and updating the connection endpoint via DNS. Because the original write region may be unavailable and the secondary has asynchronous replication, some committed writes could be missing, giving an RPO of up to 15 minutes. The human-in-the-loop action also drives RTO to minutes or hours, which fails the requirement for automatic, near-zero data loss failover.

Study all Route 53 Failover common traps →

A
Enable multi-region writes with automatic failover
Enabling multi-region writes with automatic failover makes every participating region a writable replica, so writes can be served by any region and replicated asynchronously with conflict resolution based on LSNs. Because no region is a passive secondary that must be promoted, automatic failover simply redirects traffic without waiting for data catch-up, achieving an RPO of 0 and an RTO of seconds. This is the only option that fully satisfies the requirement for near-zero data loss and automatic cross-region failover.
B
Enable automatic failover from a single write region to a read region
Why it fails: With a single write region, enabling automatic failover designates one read-only region to become the new write region if the primary fails, but replication between regions is asynchronous. Therefore the promoted region can be up to 15 minutes behind, meaning committed writes may be lost, so the effective RPO is not zero. The failover process also involves detection, health probes, and DNS update, which adds RTO delay; this option addresses availability but not the requirement of zero data loss.
C
Deploy Cosmos DB in an availability zone-enabled region
Why it fails: Availability-zone-enabled Cosmos DB replicates data synchronously across multiple zones within a single Azure region, protecting against rack or datacenter failures but providing no cross-region redundancy. Because all zones are part of the same regional footprint, a regional outage takes down the entire deployment, making failover impossible. This option is about high availability within a region, not the cross-region disaster recovery and failover behavior the scenario requires.
D
Use manual failover to a secondary read region
Why it fails: A manual failover to a secondary read region requires an operator to trigger the promotion after a failure is detected, and the process includes waiting for the read region to catch up and updating the connection endpoint via DNS. Because the original write region may be unavailable and the secondary has asynchronous replication, some committed writes could be missing, giving an RPO of up to 15 minutes. The human-in-the-loop action also drives RTO to minutes or hours, which fails the requirement for automatic, near-zero data loss failover.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Route 53 Failover sessions

Start a Route 53 Failover only practice session

Every question in these sessions is drawn from the Route 53 Failover domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Route 53 Failover questions →Mixed AZ-305 session

Frequently asked questions

What does the AZ-305 exam test about Route 53 Failover?: Route 53 Failover questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Route 53 Failover questions in a focused session?: Yes — the session launcher on this page draws every question from the Route 53 Failover domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other AZ-305 topics?: Use the topic links above to move to related areas, or go back to the AZ-305 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the AZ-305 exam covers. They are not copied from any real exam or dump site.

Route 53 Failover only

10 questions 20 questions 30 questions 50 questions

Mixed AZ-305 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All AZ-305 questions Route 53 Failover domain overview AZ-305 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Route 53 Failover practice questions

What to know about Route 53 Failover

Common Route 53 Failover exam traps

Route 53 Failover questions

A company is designing a highly available architecture for a web application on Azure VMs. The solution must protect against both planned and unplanned downtime and provide automatic failover. Which TWO Azure services should the company use together? (Choose two.)

You are designing a high-availability solution for a stateless web application running on Azure VMs. The solution must provide automatic failover to another region in the event of a regional outage. Which Azure service should you use to distribute traffic across regions?

Which TWO of the following Azure services can be used to enable automatic failover of a web application across Azure regions?

A company uses Azure Cosmos DB with a single write region. They need to ensure business continuity with an RPO of 5 seconds and RTO of 1 minute in case of a regional outage. What configuration should they use?

Track your progress over time

Start a Route 53 Failover only practice session

Related AZ-305 topic practice pages

Design infrastructure solutions practice questions

Design identity, governance, and monitoring solutions practice questions

Design data storage solutions practice questions

Design business continuity solutions practice questions

SAA-C03 VPC practice questions

SAA-C03 S3 lifecycle policy questions

SAA-C03 RDS Multi-AZ questions

SAA-C03 IAM policy practice questions

SAA-C03 Route 53 failover questions

SAA-C03 CloudFront practice questions

SAA-C03 NAT gateway questions

SAA-C03 VPC endpoint questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid