AZ-900 Describe Azure architecture and services Practice Question
A company hosts a public-facing web application on Azure Virtual Machines in two separate Azure regions for disaster recovery. The application's domain is managed by a third-party registrar. The company needs a solution that can route user traffic to the nearest healthy regional endpoint based on geographic location and provides automatic failover if an entire region becomes unavailable. The solution should not inspect or modify the HTTP traffic (no SSL termination or web application firewall). Which Azure service should the company use?
⚠ Common exam trap
Candidates often confuse Azure Traffic Manager (DNS-level, no traffic inspection) with Azure Front Door (global HTTP load balancer with SSL termination and WAF), leading them to choose Front Door when the requirement explicitly prohibits HTTP inspection or modification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Traffic Manager
Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming DNS requests to the nearest healthy regional endpoint based on geographic location or latency. It supports automatic failover by monitoring endpoint health and redirecting traffic if an entire region becomes unavailable, and it operates at the DNS level without inspecting or modifying HTTP traffic, so no SSL termination or web application firewall is involved.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer is a regional service that distributes inbound traffic across virtual machines or instances within a single Azure region, operating at Layer 4 (TCP/UDP) of the OSI model. Because it sits regionally and does not participate in DNS-based routing or maintain a presence in multiple regions, it cannot direct users to a different Azure region based on geographic location or perform cross-region failover. While it does perform health checks, its scope is limited to backends in the same region, making it unsuitable for a global, region-resilient routing scenario.
When this WOULD be correct
If the question required distributing incoming traffic across multiple virtual machines in a single Azure region for high availability and scalability, with no need for geographic routing or cross-region failover, Azure Load Balancer would be the correct choice.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a regional Layer 7 load balancer that provides SSL termination, web application firewall, and URL-based routing. It does not provide cross-region geographic failover and would modify HTTP traffic, which is not required in this scenario.
When this WOULD be correct
A company needs to route HTTP traffic to a web application hosted on Azure VMs, requiring SSL termination, URL-based routing, and a web application firewall to protect against common web vulnerabilities. The application is deployed in a single region or multiple regions with a need for Layer 7 load balancing and security features.
- ✓
Azure Traffic Manager
Why this is correct
Azure Traffic Manager is a DNS-based traffic router that can direct users to endpoints in different Azure regions based on geographic location, performance, or priority. It monitors endpoint health and automatically fails over if a region goes down, all without inspecting or modifying HTTP traffic.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is a global Layer 7 service that offers SSL termination, web application firewall, and caching. It operates at the application layer and modifies HTTP traffic (e.g., by terminating TLS). The requirement states no HTTP inspection or modification, so Front Door is not suitable.
When this WOULD be correct
A company needs global load balancing with SSL offloading, web application firewall, and URL-based routing for an HTTP/HTTPS application. Azure Front Door would be correct because it provides these application-layer features.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Traffic ManagerCorrect answer▾
Why this is correct
Azure Traffic Manager is a DNS-based traffic router that can direct users to endpoints in different Azure regions based on geographic location, performance, or priority. It monitors endpoint health and automatically fails over if a region goes down, all without inspecting or modifying HTTP traffic.
✗Azure Load BalancerWrong answer — click to see why▾
Why this is wrong here
Azure Load Balancer operates at Layer 4 and distributes traffic within a single region; it cannot route based on geographic location or provide cross-region failover.
★ When this WOULD be the correct answer
If the question required distributing incoming traffic across multiple virtual machines in a single Azure region for high availability and scalability, with no need for geographic routing or cross-region failover, Azure Load Balancer would be the correct choice.
Why candidates choose this
Candidates may confuse Load Balancer's regional load balancing with global traffic routing, or assume it can handle multi-region failover because it supports backend pools across availability zones.
✗Azure Application GatewayWrong answer — click to see why▾
Why this is wrong here
Azure Application Gateway operates at Layer 7 (HTTP/HTTPS) and can inspect/modify traffic, including SSL termination and web application firewall capabilities. The question explicitly requires a solution that does not inspect or modify HTTP traffic, and Application Gateway does not provide geographic routing or automatic failover across regions based on endpoint health.
★ When this WOULD be the correct answer
A company needs to route HTTP traffic to a web application hosted on Azure VMs, requiring SSL termination, URL-based routing, and a web application firewall to protect against common web vulnerabilities. The application is deployed in a single region or multiple regions with a need for Layer 7 load balancing and security features.
Why candidates choose this
Candidates may confuse Application Gateway's load balancing and health probe capabilities with Traffic Manager's global routing, or assume that because it can handle HTTP traffic, it can also perform geographic routing and failover across regions.
✗Azure Front DoorWrong answer — click to see why▾
Why this is wrong here
Azure Front Door inspects and modifies HTTP traffic (e.g., SSL termination, web application firewall), which violates the requirement that the solution should not inspect or modify HTTP traffic. Traffic Manager operates at the DNS level and does not inspect traffic.
★ When this WOULD be the correct answer
A company needs global load balancing with SSL offloading, web application firewall, and URL-based routing for an HTTP/HTTPS application. Azure Front Door would be correct because it provides these application-layer features.
Why candidates choose this
Candidates may confuse Front Door's global routing and failover capabilities with Traffic Manager's, not realizing Front Door operates at Layer 7 and inspects traffic, while Traffic Manager is DNS-based and does not.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Region
A region is a distinct geographic location where a cloud provider operates multiple data centers that are connected by low-latency networks and provide cloud services.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.