AZ-500 Secure networking Practice Question
A company runs a global web application on Azure App Service instances deployed in multiple Azure regions. They want to protect the application from common web attacks such as SQL injection and cross-site scripting (XSS) using a centralized set of managed rules that can be automatically updated. They also need to improve performance by terminating traffic at the nearest point of presence (POP) to end users. Which Azure service should they deploy in front of the App Service?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Application Gateway (regional, Layer 7 load balancer with WAF) with Azure Front Door (global, multi-region, with WAF), failing to recognize that only Front Door provides both global POP termination and centralized WAF for multi-region deployments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Front Door with Web Application Firewall (WAF)
Azure Front Door with WAF is correct because it provides global, centralized protection against common web attacks (SQL injection, XSS) using managed rule sets that are automatically updated, and it terminates traffic at the nearest point of presence (POP) to end users, improving performance through global load balancing and TLS termination. This meets both the security and performance requirements for a multi-region App Service deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Application Gateway with Web Application Firewall (WAF)
Why it's wrong here
Azure Application Gateway with WAF provides layer-7 protection, including managed rule sets, and Secure Sockets Layer (SSL) termination, but it operates as a regional service within a single Azure region and virtual network. It cannot use anycast to bring traffic to the globally nearest edge node, so a user in another continent will still traverse the public internet to that region. For a global web application, you need a service that both scales across regions and terminates attacks at the edge, which Application Gateway alone cannot do.
- ✓
Azure Front Door with Web Application Firewall (WAF)
Why this is correct
Azure Front Door with WAF is a global layer-7 service that uses the Microsoft global edge network with anycast, ensuring connections are terminated at the nearest point of presence (POP) rather than the origin region. It applies Web Application Firewall rules, including OWASP managed rule sets, at that edge, which blocks malicious requests before they traverse the backbone to your web app. This combination of global load balancing, TLS termination, and built-in WAF protection directly addresses both performance and security requirements for a worldwide audience.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager is a DNS-based traffic load balancer; it resolves the domain name to one of multiple endpoints based on routing methods, but it never sees the actual HTTP/S traffic. Because it operates only at the DNS level, it cannot terminate TLS, inspect payloads, or run any Web Application Firewall rules to block SQL injection or cross-site scripting attacks. Without application-layer filtering, it is useless against the OWASP Top 10 threats that a WAF is meant to mitigate.
- ✗
Azure CDN (Content Delivery Network)
Why it's wrong here
Azure CDN is built for caching and delivering static content from edge nodes, improving performance by serving cached copies close to users; it is not an application-layer security gateway. Although you can place a WAF in front of the CDN origin, the CDN itself does not provide a managed Web Application Firewall rule set to inspect dynamic requests or enforce bot mitigation. For dynamic API calls or sensitive pages, traffic often bypasses the cache and goes straight to the origin unexamined, leaving your app vulnerable compared to Front Door's edge WAF.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.