Azure Services Offering Layer 7 Load Balancing
Which TWO Azure services can be used to distribute incoming traffic across multiple virtual machines in a backend pool while providing layer 7 load balancing? (Choose two.)
Quick Answer
The answer is Azure Application Gateway and Azure Front Door. Both are Azure services that provide layer 7 load balancing, meaning they route traffic based on HTTP/HTTPS attributes like URL paths, host headers, or cookies, rather than just IP and port data used at layer 4. Application Gateway excels at regional load balancing with features like SSL termination and Web Application Firewall (WAF), while Front Door operates globally, offering acceleration and cross-region failover. On the AZ-500 exam, this distinction tests your understanding of network security controls: Application Gateway is often paired with WAF policies to protect web apps inside a virtual network, whereas Front Door is used for global ingress with DDoS protection. A common trap is confusing Azure Load Balancer (layer 4) with these layer 7 services—remember, if it inspects HTTP headers or cookies, it’s layer 7. Memory tip: think “Gateway for regional, Front Door for global”—both handle the seventh layer, but one stays local, the other spans the world.
⚠ Common exam trap
Many candidates confuse Azure Load Balancer (layer 4) with Azure Application Gateway (layer 7), assuming both can perform HTTP-based routing, but only Application Gateway can inspect and route based on application-layer data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway
Azure Application Gateway is a layer 7 load balancer that can distribute incoming traffic across multiple virtual machines in a backend pool based on HTTP/HTTPS attributes such as URL path, host headers, and cookies. It also provides SSL termination, Web Application Firewall (WAF), and session affinity, making it suitable for web application traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer is layer 4 (TCP/UDP), not layer 7.
- ✓
Azure Application Gateway
Why this is correct
Application Gateway is a layer 7 load balancer with HTTP/HTTPS support.
- ✗
Azure Traffic Manager
Why it's wrong here
Traffic Manager is DNS-based load balancing, not a proxy; it does not terminate HTTP traffic.
- ✗
Azure VPN Gateway
Why it's wrong here
VPN Gateway is for encrypted tunnels, not load balancing.
- ✓
Azure Front Door
Why this is correct
Azure Front Door is a global layer 7 load balancer for web traffic.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to distribute incoming internet traffic across multiple Azure virtual machines in the same region. The solution must provide layer 7 load balancing and SSL offloading. Which Azure service should you use?
easy- ✓ A.Azure Application Gateway
- B.Azure Traffic Manager
- C.Azure Load Balancer
- D.Azure Front Door
Why A: Azure Application Gateway is a layer 7 load balancer that can distribute incoming traffic across multiple Azure virtual machines in the same region. It supports SSL termination (offloading), which offloads the decryption work from the backend VMs, and provides advanced routing based on URL path, host headers, or other HTTP attributes.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.