Question 155 of 1,031

Describe Azure architecture and services →mediumMultiple ChoiceObjective-mapped

Quick Answer

Azure Front Door is the correct choice because it is the only Azure service that natively combines global load balancing with WAF and caching into a single, unified solution for a global e-commerce API. Technically, Front Door operates at the edge of the Azure network, distributing traffic across multiple regions using anycast routing for low-latency global load balancing, while its integrated Web Application Firewall blocks SQL injection and cross-site scripting at the edge, and its built-in caching engine stores static API responses to reduce backend load. On the AZ-900 exam, this question tests your ability to distinguish between Azure services that offer overlapping features—a common trap is confusing Azure Traffic Manager (which only does DNS-based load balancing) or Azure Application Gateway (which is regional, not global) with Front Door’s full global feature set. Remember the mnemonic: “Front Door Fronts the World”—it’s the single global entry point for security, speed, and scale.

AZ-900 Describe Azure architecture and services Practice Question

This AZ-900 practice question tests your understanding of describe azure architecture and services. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company operates a global e-commerce API that serves customers worldwide. The development team needs a solution that provides the following capabilities: global load balancing across deployed instances in multiple Azure regions, web application firewall (WAF) protection against common exploits like SQL injection and cross-site scripting, TLS termination at the edge to reduce backend processing, and caching of static API responses to improve response times for repeated requests. The team wants a single Azure service that integrates all these features natively. Which Azure service should they use?

Question 1mediummultiple choice

Read the full NAT/PAT explanation →

A
Azure Front Door
Azure Front Door is a global application delivery network that provides layer 7 load balancing, WAF, SSL/TLS termination, and caching. It is designed for global applications and meets all the specified requirements natively.
B
Azure Traffic Manager
Why wrong: Azure Traffic Manager is a DNS-based traffic load balancer that routes traffic based on performance or geography, but it does not include a web application firewall, TLS termination, or caching capabilities. It operates at the DNS layer only.
C
Azure Application Gateway
Why wrong: Azure Application Gateway is a regional load balancer that does include WAF and caching, but it cannot provide global load balancing across multiple Azure regions. It is limited to a single region, so it cannot meet the global routing requirement.
D
Azure Content Delivery Network (CDN)
Why wrong: Azure CDN provides caching and some edge security features, but it does not offer built-in global load balancing or a native web application firewall. It is primarily a content caching and acceleration service, not a full-featured global load balancer with WAF.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Azure Front Door

Azure Front Door is the correct choice because it is a global, scalable entry point that natively integrates global load balancing, web application firewall (WAF) protection, TLS termination at the edge, and caching of static API responses. Unlike other services, Front Door provides all these capabilities in a single, unified service, making it ideal for a global e-commerce API that requires both security and performance optimization across multiple Azure regions.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Azure Front Door
Why this is correct
Azure Front Door is a global application delivery network that provides layer 7 load balancing, WAF, SSL/TLS termination, and caching. It is designed for global applications and meets all the specified requirements natively.
Related concept
Read the scenario before looking for a memorised answer.
✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager is a DNS-based traffic load balancer that routes traffic based on performance or geography, but it does not include a web application firewall, TLS termination, or caching capabilities. It operates at the DNS layer only.
✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a regional load balancer that does include WAF and caching, but it cannot provide global load balancing across multiple Azure regions. It is limited to a single region, so it cannot meet the global routing requirement.
✗
Azure Content Delivery Network (CDN)
Why it's wrong here
Azure CDN provides caching and some edge security features, but it does not offer built-in global load balancing or a native web application firewall. It is primarily a content caching and acceleration service, not a full-featured global load balancer with WAF.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often confuse Azure Front Door with Azure Application Gateway, mistakenly thinking Application Gateway provides global load balancing, when in fact it is a regional service and cannot route traffic across multiple Azure regions without additional services.

Detailed technical explanation

How to think about this question

Azure Front Door operates at the application layer (HTTP/HTTPS) using Anycast protocol to route traffic to the nearest healthy backend region, and it supports path-based routing, URL rewrites, and session affinity. Its integrated WAF uses OWASP Core Rule Sets to block SQL injection and XSS at the edge, and its caching engine respects Cache-Control headers, reducing origin load for repeated requests. In a real-world scenario, a global e-commerce API can use Front Door to terminate TLS in over 100 edge locations, offload SSL processing, and serve cached product listings while dynamically routing checkout requests to the closest regional instance.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related AZ-900 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Describe cloud concepts practice questions

Practise AZ-900 questions linked to Describe cloud concepts.

Describe Azure architecture and services practice questions

Practise AZ-900 questions linked to Describe Azure architecture and services.

Describe Azure management and governance practice questions

Practise AZ-900 questions linked to Describe Azure management and governance.

AZ-900 Azure services practice questions

Practise AZ-900 questions linked to AZ-900 Azure services.

AZ-900 pricing and support practice questions

Practise AZ-900 questions linked to AZ-900 pricing and support.

AZ-900 security and compliance practice questions

Practise AZ-900 questions linked to AZ-900 security and compliance.

AZ-900 governance practice questions

Practise AZ-900 questions linked to AZ-900 governance.

Practice this exam

Start a free AZ-900 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

AZ-900 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this AZ-900 question test?

Describe Azure architecture and services — This question tests Describe Azure architecture and services — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Azure Front Door — Azure Front Door is the correct choice because it is a global, scalable entry point that natively integrates global load balancing, web application firewall (WAF) protection, TLS termination at the edge, and caching of static API responses. Unlike other services, Front Door provides all these capabilities in a single, unified service, making it ideal for a global e-commerce API that requires both security and performance optimization across multiple Azure regions.

What should I do if I get this AZ-900 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.