AZ-900 Describe Azure architecture and services Practice Question
A company runs a web application in two Azure regions: East US and West US. The company wants to route users automatically to the region that provides the lowest network latency. If one region becomes unavailable, all traffic should be rerouted to the healthy region. The company does not need to offload Transport Layer Security (TLS) or perform URL-based routing. Which Azure service should the company use to distribute traffic at the DNS level?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Traffic Manager (DNS-level, cross-region) with Azure Load Balancer (transport-level, single-region) or Azure Application Gateway (application-level, with TLS/URL features), failing to recognize that only Traffic Manager provides global latency-based routing at the DNS layer without requiring TLS offloading or URL path inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Traffic Manager
Azure Traffic Manager operates at the DNS level, using DNS responses to direct user traffic to the region with the lowest network latency based on the Performance traffic-routing method. It also supports automatic failover: if a region becomes unavailable, Traffic Manager detects the endpoint health probe failure and reroutes all traffic to the healthy region. This matches the requirement exactly, as the company needs DNS-level distribution without TLS offloading or URL-based routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Traffic Manager
Why this is correct
Azure Traffic Manager is a DNS-based global traffic router that directs user traffic to the nearest available endpoint using routing methods such as performance, priority, or geographic. It continuously monitors the health of each endpoint via probes and automatically redirects traffic away from a failed region, enabling cross-region failover. Because it operates at the DNS layer, it does not terminate TLS or inspect URLs, making it the simplest and most cost-effective choice for a company that only needs multi-region redirection and failover.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer is a Layer 4 (TCP/UDP) load balancer that operates within a single Azure region, distributing incoming traffic to virtual machines or instances in the same backend pool. It does not use DNS for routing and has no capability to direct users to different geographic regions or fail over across regions. Even when configured as a public load balancer, it only balances traffic inside that region's boundaries, so it cannot meet the requirement of routing between two Azure regions.
- ✗
Azure Application Gateway
Why it's wrong here
Incorrect. Azure Application Gateway is a regional Layer 7 load balancer that supports URL-based routing and TLS offloading. It is designed for intra-region traffic distribution and does not route traffic across regions based on DNS or latency.
- ✗
Azure Front Door
Why it's wrong here
Incorrect. While Azure Front Door can route traffic globally and support performance routing and failover, it also includes additional features such as global TLS offloading, web application firewall (WAF), and URL-based routing. Although it could technically meet the requirement, it is an overly complex solution compared to Traffic Manager. The question specifies that the company does not need TLS offloading or URL routing, making Traffic Manager the most appropriate and cost-effective choice.
When this WOULD be correct
A company needs to distribute traffic across multiple regions with features like TLS offloading, URL path-based routing, web application firewall (WAF), and acceleration of dynamic content. The question would specify requirements for HTTP/HTTPS traffic management and security features.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Traffic ManagerCorrect answer▾
Why this is correct
Azure Traffic Manager is a DNS-based global traffic router that directs user traffic to the nearest available endpoint using routing methods such as performance, priority, or geographic. It continuously monitors the health of each endpoint via probes and automatically redirects traffic away from a failed region, enabling cross-region failover. Because it operates at the DNS layer, it does not terminate TLS or inspect URLs, making it the simplest and most cost-effective choice for a company that only needs multi-region redirection and failover.
✗Azure Front DoorWrong answer — click to see why▾
Why this is wrong here
Azure Front Door operates at Layer 7 (HTTP/HTTPS) and provides global load balancing with TLS offloading and URL-based routing, which the question explicitly states are not needed. The requirement is for DNS-level traffic distribution based on latency and regional failover, which is exactly what Traffic Manager provides.
★ When this WOULD be the correct answer
A company needs to distribute traffic across multiple regions with features like TLS offloading, URL path-based routing, web application firewall (WAF), and acceleration of dynamic content. The question would specify requirements for HTTP/HTTPS traffic management and security features.
Why candidates choose this
Candidates may confuse Azure Front Door with Traffic Manager because both provide global load balancing and routing based on latency, but Front Door operates at Layer 7 with additional features, while Traffic Manager is a pure DNS-level service.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.