AZ-900 Describe Azure architecture and services Practice Question
A company deploys a critical application across two Azure regions for disaster recovery. They want to automatically failover traffic to the secondary region if the primary becomes unavailable. They also want to improve performance by routing users to the closest region. Which Azure service should they use?
⚠ Common exam trap
It's easy for candidates to confuse Azure Traffic Manager (global DNS-based routing) with Azure Load Balancer (regional Layer 4 load balancing), assuming both can handle cross-region failover when only Traffic Manager can.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Traffic Manager
Azure Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic optimally to services across global Azure regions. It supports the 'Priority' routing method for automatic failover to a secondary region when the primary is unavailable, and the 'Performance' routing method to direct users to the closest region for improved latency. This combination directly meets the stated requirements for disaster recovery failover and performance-based routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Traffic Manager
Why this is correct
Azure Traffic Manager operates at the DNS layer, resolving user queries to the optimal regional endpoint based on priority, geographic proximity, or latency. It continuously health-checks endpoints and automatically redirects traffic away from an unavailable region, thereby achieving global failover. Unlike packet-level balancers, it never inspects or forwards packets directly.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer is a regional, layer 4 (TCP/UDP) load balancer that distributes incoming traffic to healthy backend instances within a single Azure region. It cannot route traffic across multiple regions, nor does it perform global DNS resolution, so it offers no cross-region failover by itself. It is typically used behind Traffic Manager when an application spans Azure regions.
When this WOULD be correct
A company has a web application deployed on multiple VMs in the same Azure region and needs to distribute incoming traffic evenly across those VMs for high availability and scalability.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway provides regional, layer 7 HTTP/S load balancing with features like cookie affinity, path-based routing, and a Web Application Firewall, but it is confined to one region and one set of backend pools. It does not have global DNS visibility or the ability to reroute users to an alternate region if the whole regional deployment becomes unhealthy. Therefore, it is an incorrect choice for multi-region failover.
When this WOULD be correct
Azure Application Gateway would be correct if the question asked for a service to load balance HTTP/S traffic within a single region, with features like SSL offloading, cookie-based session affinity, or URL path-based routing, and no requirement for multi-region failover or global traffic management.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway is a network connectivity service that establishes encrypted IPsec tunnels between on-premises locations or individual clients and an Azure virtual network. It is designed for secure site-to-site or point-to-site access, not for distributing HTTP/S application traffic or making routing decisions based on endpoint health. As such, it cannot satisfy a multi-region failover requirement.
When this WOULD be correct
A company needs to establish secure, site-to-site connectivity between an on-premises data center and Azure virtual networks, or connect multiple VNets across regions via encrypted tunnels.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Traffic ManagerCorrect answer▾
Why this is correct
Azure Traffic Manager operates at the DNS layer, resolving user queries to the optimal regional endpoint based on priority, geographic proximity, or latency. It continuously health-checks endpoints and automatically redirects traffic away from an unavailable region, thereby achieving global failover. Unlike packet-level balancers, it never inspects or forwards packets directly.
✗Azure Load BalancerWrong answer — click to see why▾
Why this is wrong here
Azure Load Balancer distributes traffic within a single region and does not support cross-region failover or geographic routing based on user proximity.
★ When this WOULD be the correct answer
A company has a web application deployed on multiple VMs in the same Azure region and needs to distribute incoming traffic evenly across those VMs for high availability and scalability.
Why candidates choose this
Candidates may confuse load balancing with traffic routing, assuming that any 'load balancer' can handle global failover and performance optimization across regions.
✗Azure Application GatewayWrong answer — click to see why▾
Why this is wrong here
Azure Application Gateway is a layer 7 load balancer focused on HTTP/S traffic, with features like SSL termination and URL-based routing. It does not support DNS-based global traffic routing or failover across regions, which are required for disaster recovery and geographic proximity routing.
★ When this WOULD be the correct answer
Azure Application Gateway would be correct if the question asked for a service to load balance HTTP/S traffic within a single region, with features like SSL offloading, cookie-based session affinity, or URL path-based routing, and no requirement for multi-region failover or global traffic management.
Why candidates choose this
Candidates may confuse Application Gateway's load balancing capabilities with global traffic management, or think its layer 7 features (like health probes) can handle cross-region failover, not realizing it operates only within a single region.
✗Azure VPN GatewayWrong answer — click to see why▾
Why this is wrong here
Azure VPN Gateway connects on-premises networks to Azure via encrypted tunnels; it does not provide global traffic routing, failover, or performance-based routing across regions.
★ When this WOULD be the correct answer
A company needs to establish secure, site-to-site connectivity between an on-premises data center and Azure virtual networks, or connect multiple VNets across regions via encrypted tunnels.
Why candidates choose this
Candidates may confuse VPN Gateway with Traffic Manager because both involve 'gateway' and 'traffic' concepts, or assume VPN is needed for secure failover routing.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Azure Traffic Manager
Azure Traffic Manager is a DNS-based traffic load balancer that directs incoming web traffic to the most appropriate endpoint based on performance, priority, geographic location, or a weighted distribution method.
Key term
Region
A region is a distinct geographic location where a cloud provider operates multiple data centers that are connected by low-latency networks and provide cloud services.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.