AZ-900 Describe Azure architecture and services Practice Question
A company operates a global e-commerce API that serves customers worldwide. The development team needs a solution that provides the following capabilities: global load balancing across deployed instances in multiple Azure regions, web application firewall (WAF) protection against common exploits like SQL injection and cross-site scripting, TLS termination at the edge to reduce backend processing, and caching of static API responses to improve response times for repeated requests. The team wants a single Azure service that integrates all these features natively. Which Azure service should they use?
⚠ Common exam trap
Many candidates confuse Azure Front Door with Azure Application Gateway, mistakenly thinking Application Gateway provides global load balancing, when in fact it is a regional service and cannot route traffic across multiple Azure regions without additional services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Front Door
Azure Front Door is the correct choice because it is a global, scalable entry point that natively integrates global load balancing, web application firewall (WAF) protection, TLS termination at the edge, and caching of static API responses. Unlike other services, Front Door provides all these capabilities in a single, unified service, making it ideal for a global e-commerce API that requires both security and performance optimization across multiple Azure regions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Front Door
Why this is correct
Azure Front Door is a global application delivery network that provides layer 7 load balancing, Web Application Firewall (WAF), SSL/TLS termination, and caching at the network edge. It uses anycast to route user requests to the nearest available point of presence, then intelligently forwards traffic to the healthiest and fastest backend across multiple Azure regions. This native global routing capability, combined with built-in WAF and TLS offload, directly satisfies all requirements for a global e-commerce API without additional components.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager is a DNS-based traffic load balancer that routes traffic based on performance or geography, but it does not include a web application firewall, TLS termination, or caching capabilities. It operates at the DNS layer only.
When this WOULD be correct
A company needs to distribute traffic across endpoints in different Azure regions based on routing methods like performance, priority, or geographic, without requiring WAF, TLS termination, or caching at the service level.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a regional load balancer that does include WAF and caching, but it cannot provide global load balancing across multiple Azure regions. It is limited to a single region, so it cannot meet the global routing requirement.
When this WOULD be correct
A company operates a web application deployed in a single Azure region and needs a service that provides regional load balancing, WAF protection, TLS termination, and caching for that region. Azure Application Gateway would be the correct choice because it offers all these features within a region.
- ✗
Azure Content Delivery Network (CDN)
Why it's wrong here
Azure CDN provides caching and some edge security features, but it does not offer built-in global load balancing or a native web application firewall. It is primarily a content caching and acceleration service, not a full-featured global load balancer with WAF.
When this WOULD be correct
An exam scenario where the requirement is solely to cache and deliver static content (e.g., images, videos) globally with low latency, without needing load balancing, WAF, or TLS termination.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Front DoorCorrect answer▾
Why this is correct
Azure Front Door is a global application delivery network that provides layer 7 load balancing, Web Application Firewall (WAF), SSL/TLS termination, and caching at the network edge. It uses anycast to route user requests to the nearest available point of presence, then intelligently forwards traffic to the healthiest and fastest backend across multiple Azure regions. This native global routing capability, combined with built-in WAF and TLS offload, directly satisfies all requirements for a global e-commerce API without additional components.
✗Azure Traffic ManagerWrong answer — click to see why▾
Why this is wrong here
Azure Traffic Manager provides DNS-based global load balancing but lacks native WAF, TLS termination, and caching capabilities required by the question.
★ When this WOULD be the correct answer
A company needs to distribute traffic across endpoints in different Azure regions based on routing methods like performance, priority, or geographic, without requiring WAF, TLS termination, or caching at the service level.
Why candidates choose this
Candidates may confuse Traffic Manager's global load balancing with Front Door's integrated features, overlooking that Traffic Manager operates only at the DNS level without application-layer protections.
✗Azure Application GatewayWrong answer — click to see why▾
Why this is wrong here
Azure Application Gateway provides regional load balancing, WAF, TLS termination, and caching, but it does not offer global load balancing across multiple Azure regions. The question requires a single service that integrates all these features globally, which is Azure Front Door.
★ When this WOULD be the correct answer
A company operates a web application deployed in a single Azure region and needs a service that provides regional load balancing, WAF protection, TLS termination, and caching for that region. Azure Application Gateway would be the correct choice because it offers all these features within a region.
Why candidates choose this
Candidates may confuse Azure Application Gateway's WAF, TLS termination, and caching capabilities with the global requirements of the question, overlooking the critical need for multi-region global load balancing that only Azure Front Door provides.
✗Azure Content Delivery Network (CDN)Wrong answer — click to see why▾
Why this is wrong here
Azure CDN does not provide global load balancing across multiple Azure regions, WAF protection, or TLS termination at the edge; it focuses on content caching and delivery from edge nodes.
★ When this WOULD be the correct answer
An exam scenario where the requirement is solely to cache and deliver static content (e.g., images, videos) globally with low latency, without needing load balancing, WAF, or TLS termination.
Why candidates choose this
Candidates may confuse Azure CDN's global edge presence and caching capabilities with the integrated features of Azure Front Door, assuming CDN can also handle load balancing and security.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Azure Front Door
Azure Front Door is a global cloud load balancer and content delivery network that routes user traffic to the fastest and most available backend application across multiple regions.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.