Azure Services Offering Layer 7 Load Balancing
You need to distribute incoming internet traffic across multiple Azure virtual machines in the same region. The solution must provide layer 7 load balancing and SSL offloading. Which Azure service should you use?
⚠ Common exam trap
Many exam-takers confuse Azure Front Door (global, multi-region) with Azure Application Gateway (regional, single-region), as both offer layer 7 features and SSL offloading, but the question explicitly specifies 'same region'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway
Azure Application Gateway is a layer 7 load balancer that can distribute incoming traffic across multiple Azure virtual machines in the same region. It supports SSL termination (offloading), which offloads the decryption work from the backend VMs, and provides advanced routing based on URL path, host headers, or other HTTP attributes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Application Gateway
Why this is correct
Azure Application Gateway is the correct choice because it is a regional Layer 7 load balancer that operates at the HTTP/HTTPS application layer. It can distribute incoming internet traffic across VMs in the same region, perform SSL offloading, and route based on URL paths or host headers. This combination of regional scope and application-level inspection makes it uniquely suited to this requirement.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager does not proxy or inspect traffic; it only responds to DNS queries with an endpoint IP address based on policies like performance or weighted routing. Because it never sees the HTTP payload, it cannot perform Layer 7 operations such as path-based routing or SSL termination. Its global, DNS-level design is a mismatch for a regional deployment requiring fine-grained traffic distribution.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer is a regional Layer 4 load balancer that forwards packets using a five-tuple hash (source IP, source port, destination IP, destination port, and protocol). It cannot read HTTP headers, support URL-based routing, or terminate SSL, so it lacks the Layer 7 capabilities required here. Although it is regional, it operates at the transport layer and therefore does not fulfill the intended traffic distribution logic.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is a global Layer 7 HTTP/HTTPS entry point that accelerates and load-balances traffic across multiple regions at the edge. Its geographic scope is broader than a single regional deployment, making it unnecessary and unsuitable when all backend instances reside within one region. Since the requirement is regional, a regional service like Application Gateway is a better fit, not a global service like Front Door.
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.