AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Azure Virtual Network with subnets and Network Security Groups

  Why this is correct

  Correct. A Virtual Network defines a private IP address space in Azure, and subnets segment that space into separate tiers (web, application, database). Network Security Groups act as distributed stateful firewalls, with rules that allow or deny traffic by source/destination IP, port, and protocol—for example, permitting only the web tier's subnet to reach the database tier on port 1433 while blocking all other cross-tier traffic. This combination provides both network isolation and granular access control, which is exactly what multi-tier security requires.

• ✗

  Azure Application Gateway

  Why it's wrong here

  Incorrect. Azure Application Gateway is an application-layer (layer-7) load balancer that routes HTTP/HTTPS traffic based on URL paths, host headers, and cookie affinity, and it also offers a Web Application Firewall to protect against common web exploits. It does not operate at the network layer and cannot segment a VNet into subnets or enforce IP-level access rules between tiers. Its role is to distribute inbound client traffic to web servers, not to control east-west traffic between application and database tiers.

  When this WOULD be correct

  A company needs to route HTTP traffic to a web app based on URL path or host headers, and requires SSL termination and web application firewall (WAF) protection. Azure Application Gateway would be the correct answer.

• ✗

  Azure Load Balancer

  Why it's wrong here

  Incorrect. Azure Load Balancer is a layer-4 load balancer that distributes inbound or outbound flows to backend pool instances based on rules that match IP addresses, ports, and protocols. It forwards packets (or terminates and re-originates flows) but performs no filtering or access control based on application context, and it does not segment networks or set policy between subnets. It is designed for high availability and scale, not for tier isolation; a Load Balancer could never restrict database access to only the web tier—that requires an NSG or firewall.

  When this WOULD be correct

  A question requiring high availability and load distribution for a web application across multiple virtual machines in the same region, without subnet isolation or access control between tiers.

• ✗

  Azure Traffic Manager

  Why it's wrong here

  Incorrect. Traffic Manager is a DNS-based traffic routing service that directs client requests to endpoints across different Azure regions using routing methods such as priority, weighted, performance, or geographic. It works at the DNS resolution level—it tells the client which endpoint IP to connect to—but it never inspects or filters the actual packets. Therefore, it cannot provide subnet isolation, cannot define network security rules between tiers, and has no mechanism to enforce that only the web tier can reach a database.

  When this WOULD be correct

  A company has web applications deployed in multiple Azure regions and needs to route user traffic to the nearest region for low latency and high availability. Azure Traffic Manager would be the correct solution for global traffic distribution based on performance or geographic location.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question