AZ-900 Describe Azure architecture and services Practice Question
A company hosts a public-facing e-commerce website on Azure virtual machines deployed in two Azure regions (East US and West Europe). The company wants to automatically route users to the region that provides the lowest network latency based on their geographic location. The solution must use DNS-based traffic routing and does not require terminating HTTP traffic at the load balancer. Which Azure service should the company use?
⚠ Common exam trap
Candidates often confuse Azure Front Door's global Layer 7 capabilities with DNS-level routing, but Front Door terminates HTTP traffic and is not a pure DNS-based solution, making Traffic Manager the correct choice when HTTP termination is not allowed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Traffic Manager
Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming DNS requests to the most appropriate endpoint based on the traffic-routing method selected. The 'Performance' routing method directs users to the region with the lowest network latency, and because it operates at the DNS level, it does not terminate HTTP traffic, meeting all stated requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Traffic Manager
Why this is correct
Correct. Azure Traffic Manager is a DNS-based global traffic load balancer that routes end-user traffic to the nearest regional endpoint based on the configured routing method, such as Performance (lowest latency). It does not terminate HTTP traffic and works at the DNS level.
- ✗
Azure Application Gateway
Why it's wrong here
Incorrect. Azure Application Gateway is a regional layer-7 load balancer that terminates HTTP/HTTPS traffic, performs SSL offloading, and can route based on URL paths. It is not designed for global latency-based routing and requires terminating HTTP traffic, which contradicts the requirement.
When this WOULD be correct
A company needs to route HTTP/HTTPS traffic to a web application hosted on Azure VMs, with features like SSL termination, URL-based routing, and Web Application Firewall (WAF) protection. The solution must operate at the application layer and terminate HTTP traffic at the load balancer.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is incorrect because it operates at Layer 7 (HTTP/HTTPS) and inherently terminates HTTP/HTTPS traffic at the edge, which directly contradicts the requirement that the solution "does not require terminating HTTP traffic at the load balancer." While tempting as it provides global low-latency routing based on geographic location, it is primarily designed for public-facing web applications requiring advanced Layer 7 features like SSL offloading, Web Application Firewall (WAF), or caching, where traffic termination is a fundamental aspect of its operation.
When this WOULD be correct
A company wants to route users to the nearest region based on latency, but also needs to offload SSL, provide web application firewall (WAF) protection, and cache static content. The solution must terminate HTTP/HTTPS traffic at the edge.
- ✗
Azure Load Balancer
Why it's wrong here
Incorrect. Azure Load Balancer is a regional layer-4 load balancer that distributes incoming traffic across virtual machines in the same region. It does not provide global routing based on geographic latency or DNS-level traffic management.
When this WOULD be correct
A company needs to distribute incoming traffic among multiple virtual machines in a single region for high availability and scalability, and the solution must operate at the transport layer (TCP/UDP) without DNS-based routing or geographic awareness.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Traffic ManagerCorrect answer▾
Why this is correct
Correct. Azure Traffic Manager is a DNS-based global traffic load balancer that routes end-user traffic to the nearest regional endpoint based on the configured routing method, such as Performance (lowest latency). It does not terminate HTTP traffic and works at the DNS level.
✗Azure Application GatewayWrong answer — click to see why▾
Why this is wrong here
Azure Application Gateway operates at Layer 7 (HTTP/HTTPS) and requires terminating HTTP traffic at the load balancer, which contradicts the requirement that the solution must not terminate HTTP traffic. It also does not provide DNS-based traffic routing based on geographic latency.
★ When this WOULD be the correct answer
A company needs to route HTTP/HTTPS traffic to a web application hosted on Azure VMs, with features like SSL termination, URL-based routing, and Web Application Firewall (WAF) protection. The solution must operate at the application layer and terminate HTTP traffic at the load balancer.
Why candidates choose this
Candidates may confuse Application Gateway's regional load balancing and application-layer features with the global DNS-based routing of Traffic Manager, especially since both can route traffic based on location.
✗Azure Front DoorWrong answer — click to see why▾
Why this is wrong here
Azure Front Door terminates HTTP traffic at the edge and requires an HTTP listener, but the question specifies that the solution must not terminate HTTP traffic at the load balancer. Front Door also provides global load balancing with path-based routing, not just DNS-based latency routing.
★ When this WOULD be the correct answer
A company wants to route users to the nearest region based on latency, but also needs to offload SSL, provide web application firewall (WAF) protection, and cache static content. The solution must terminate HTTP/HTTPS traffic at the edge.
Why candidates choose this
Candidates may confuse Azure Front Door with Traffic Manager because both offer global load balancing and latency-based routing, but Front Door operates at Layer 7 with HTTP termination, while Traffic Manager is DNS-based.
✗Azure Load BalancerWrong answer — click to see why▾
Why this is wrong here
Azure Load Balancer operates at Layer 4 and routes traffic based on IP and port, not DNS-based geographic latency routing. It requires terminating traffic at the load balancer and does not support multi-region latency-based routing without a global tier.
★ When this WOULD be the correct answer
A company needs to distribute incoming traffic among multiple virtual machines in a single region for high availability and scalability, and the solution must operate at the transport layer (TCP/UDP) without DNS-based routing or geographic awareness.
Why candidates choose this
Candidates may confuse Azure Load Balancer with a global load balancing solution, assuming it can route across regions based on latency, but it is regionally scoped and lacks DNS-based traffic routing capabilities.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Region
A region is a distinct geographic location where a cloud provider operates multiple data centers that are connected by low-latency networks and provide cloud services.
Key term
Azure Traffic Manager
Azure Traffic Manager is a DNS-based traffic load balancer that directs incoming web traffic to the most appropriate endpoint based on performance, priority, geographic location, or a weighted distribution method.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.