AZ-900 Describe Azure architecture and services Practice Question
A company hosts a web application in the West US region on two Azure virtual machines that are in the same virtual network. The application handles user sessions that must persist on the same virtual machine for the duration of a checkout process. The company needs to load balance incoming HTTP traffic across the two virtual machines. If one virtual machine becomes unhealthy, the load balancer must automatically stop sending new traffic to that machine. Which Azure service should the company use?
⚠ Common exam trap
Watch out — candidates often confuse layer-4 load balancing (Azure Load Balancer) with layer-7 load balancing (Application Gateway), assuming any load balancer can handle HTTP session persistence, but only Application Gateway provides the cookie-based affinity required for sticky sessions in a web application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway
Azure Application Gateway is correct because it provides HTTP/HTTPS layer-7 load balancing with session affinity (also known as sticky sessions) using cookie-based persistence, which ensures that all requests from a user during the checkout process are routed to the same virtual machine. It also includes built-in health probes that automatically stop sending traffic to an unhealthy backend VM, meeting both requirements precisely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager operates at the DNS level and is designed to route traffic across different regions, not to distribute HTTP traffic between virtual machines in the same region. It also does not support cookie-based session affinity.
When this WOULD be correct
A company needs to distribute traffic across multiple Azure regions for global load balancing and failover, with no requirement for session persistence or HTTP-level inspection. For example, routing users to the nearest region based on performance or geographic location.
- ✓
Azure Application Gateway
Why this is correct
Azure Application Gateway is a layer 7 HTTP/HTTPS load balancer that provides cookie-based session affinity (sticky sessions) and health probes. It can distribute traffic across virtual machines in the same region and automatically stop sending traffic to an unhealthy machine.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer operates at layer 4 (TCP/UDP) and does not inspect HTTP headers. It can distribute traffic and perform health probes, but it cannot provide session affinity based on cookies. It is not the best choice when HTTP-level session persistence is required.
When this WOULD be correct
A company needs to distribute non-HTTP traffic (e.g., RDP, SSH, or custom TCP/UDP) across VMs in the same region, with health probes based on port availability. For example, load balancing database connections or internal API calls where Layer 4 load balancing is sufficient.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door operates at the global HTTP/S layer and routes traffic across multiple regions for latency optimisation and global failover, but it cannot enforce session persistence to a specific virtual machine within a single-region virtual network. The requirement demands that user sessions stick to the same VM during checkout, which Front Door does not support with native session affinity for backend VMs in the same VNet. It is tempting because Front Door provides load balancing and health probing for web applications, and would be correct if the application spanned multiple Azure regions and needed global load balancing with TLS termination.
When this WOULD be correct
A company has a globally distributed web application deployed in multiple Azure regions and needs to provide fast and secure access to users worldwide. They require global load balancing, SSL offloading, and web application firewall (WAF) capabilities. Azure Front Door would be the correct choice for this scenario.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Application GatewayCorrect answer▾
Why this is correct
Azure Application Gateway is a layer 7 HTTP/HTTPS load balancer that provides cookie-based session affinity (sticky sessions) and health probes. It can distribute traffic across virtual machines in the same region and automatically stop sending traffic to an unhealthy machine.
✗Azure Traffic ManagerWrong answer — click to see why▾
Why this is wrong here
Azure Traffic Manager operates at the DNS level, routing traffic based on DNS resolution, not by inspecting HTTP sessions. It cannot ensure session persistence to the same VM for a checkout process, nor can it stop sending traffic to an unhealthy VM at the application layer.
★ When this WOULD be the correct answer
A company needs to distribute traffic across multiple Azure regions for global load balancing and failover, with no requirement for session persistence or HTTP-level inspection. For example, routing users to the nearest region based on performance or geographic location.
Why candidates choose this
Candidates may confuse Traffic Manager with a load balancer because its name suggests traffic distribution, and they might overlook the specific requirements for session persistence and HTTP-level health checks in this scenario.
✗Azure Load BalancerWrong answer — click to see why▾
Why this is wrong here
Azure Load Balancer operates at Layer 4 (TCP/UDP) and cannot perform HTTP-level session persistence or application-layer health probes. The question requires HTTP traffic handling and session persistence for a checkout process, which Application Gateway provides via cookie-based affinity.
★ When this WOULD be the correct answer
A company needs to distribute non-HTTP traffic (e.g., RDP, SSH, or custom TCP/UDP) across VMs in the same region, with health probes based on port availability. For example, load balancing database connections or internal API calls where Layer 4 load balancing is sufficient.
Why candidates choose this
Candidates often confuse Azure Load Balancer with Application Gateway because both can distribute traffic and perform health checks. They may overlook the requirement for HTTP-level session persistence and assume Load Balancer can handle it, not realizing it lacks application-layer features.
✗Azure Front DoorWrong answer — click to see why▾
Why this is wrong here
Azure Front Door is a global load balancer that operates at the application layer across regions, but the question specifies that the web application is hosted only in the West US region and requires session persistence within the same virtual network. Front Door is designed for multi-region scenarios and does not provide the required local session affinity and health monitoring for VMs in the same virtual network.
★ When this WOULD be the correct answer
A company has a globally distributed web application deployed in multiple Azure regions and needs to provide fast and secure access to users worldwide. They require global load balancing, SSL offloading, and web application firewall (WAF) capabilities. Azure Front Door would be the correct choice for this scenario.
Why candidates choose this
Candidates may confuse Azure Front Door with Application Gateway because both offer application-layer features like SSL termination and WAF. They might think Front Door is suitable for any HTTP load balancing, overlooking that it is designed for global, multi-region traffic management rather than regional, VNet-based load balancing with session persistence.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Azure Application Gateway
Azure Application Gateway is a cloud-based web traffic load balancer that manages and protects HTTP and HTTPS requests to web applications based on their URL paths and other routing rules.
Key term
Region
A region is a distinct geographic location where a cloud provider operates multiple data centers that are connected by low-latency networks and provide cloud services.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.