AZ-900 Describe Azure architecture and services Practice Question
A company runs a web application on two Azure virtual machines in the same region. The application must be accessible from the internet, and incoming traffic should be distributed evenly across both VMs. Additionally, the company needs to offload Transport Layer Security (TLS) termination to a single service and route requests based on the URL path (e.g., /images to one set of VMs, /api to another). Which Azure service should the company use?
⚠ Common exam trap
Test-takers frequently confuse Layer 4 load balancing (Azure Load Balancer) with Layer 7 application routing (Azure Application Gateway), assuming any 'load balancer' can handle URL paths and TLS offloading, but only Application Gateway operates at the HTTP/HTTPS layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway
Azure Application Gateway is the correct choice because it is a Layer 7 (HTTP/HTTPS) load balancer that supports TLS termination, URL path-based routing, and cookie-based session affinity. This allows the company to offload TLS decryption to a single service and route requests like /images or /api to different backend pools, meeting all stated requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer operates at layer 4 of the OSI model and can distribute traffic based on IP and port. However, it does not support TLS termination or URL-based routing, so it does not meet the requirements of this scenario.
When this WOULD be correct
A company needs to distribute incoming TCP/UDP traffic across multiple VMs in the same region for high availability, without requiring TLS termination or application-layer routing. For example, a non-HTTP workload like a database cluster.
- ✓
Azure Application Gateway
Why this is correct
Azure Application Gateway is a regional, layer 7 (HTTP/HTTPS) load balancer that can route client traffic to backend Azure VMs based on URL path rules, such as sending /images to one pool and /api to another. It performs TLS termination (SSL offloading) at the gateway, offloading cryptographic overhead from the VMs and centralizing certificate management. This directly meets the stated requirements of intra-region traffic distribution and URL-based routing, making it the correct service for this scenario.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager is a DNS-based traffic routing service that directs users to the most appropriate regional endpoint based on routing methods (e.g., performance, priority). It does not provide TLS termination or URL-based routing within a single region.
When this WOULD be correct
A company needs to distribute incoming traffic across multiple Azure regions for high availability and low latency, and requires DNS-based routing with health checks and failover capabilities.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door operates at the global edge layer with anycast routing and cross-region failover, but the scenario requires traffic distribution across two VMs within the same region and URL-path-based routing with TLS offloading. It is tempting because Front Door does provide TLS termination and path-based routing, but those features are designed for multi-region global load balancing, not intra-region distribution. For this single-region requirement, Azure Application Gateway would be the correct service, as it offers regional layer‑7 routing and TLS offloading without global anycast.
When this WOULD be correct
A company has a web application deployed in multiple Azure regions and needs global load balancing, TLS termination at the edge, and URL path-based routing to different regional backends. Azure Front Door would be the correct choice for this multi-region scenario.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Application GatewayCorrect answer▾
Why this is correct
Azure Application Gateway is a regional, layer 7 (HTTP/HTTPS) load balancer that can route client traffic to backend Azure VMs based on URL path rules, such as sending /images to one pool and /api to another. It performs TLS termination (SSL offloading) at the gateway, offloading cryptographic overhead from the VMs and centralizing certificate management. This directly meets the stated requirements of intra-region traffic distribution and URL-based routing, making it the correct service for this scenario.
✗Azure Load BalancerWrong answer — click to see why▾
Why this is wrong here
Azure Load Balancer operates at Layer 4 (TCP/UDP) and cannot perform TLS termination or URL path-based routing, which are required for this scenario.
★ When this WOULD be the correct answer
A company needs to distribute incoming TCP/UDP traffic across multiple VMs in the same region for high availability, without requiring TLS termination or application-layer routing. For example, a non-HTTP workload like a database cluster.
Why candidates choose this
Candidates may confuse Azure Load Balancer with Application Gateway because both distribute traffic, but Load Balancer is simpler and often the first choice for basic load balancing, leading them to overlook the need for Layer 7 features like TLS offload and path-based routing.
✗Azure Traffic ManagerWrong answer — click to see why▾
Why this is wrong here
Azure Traffic Manager operates at the DNS level for global traffic distribution across regions, not for load balancing within a region or for TLS termination and URL path-based routing.
★ When this WOULD be the correct answer
A company needs to distribute incoming traffic across multiple Azure regions for high availability and low latency, and requires DNS-based routing with health checks and failover capabilities.
Why candidates choose this
Candidates may confuse Traffic Manager's global load balancing with the regional load balancing and application-layer features needed here, or assume 'traffic distribution' implies it handles all routing scenarios.
✗Azure Front DoorWrong answer — click to see why▾
Why this is wrong here
Azure Front Door operates at the global/application layer (HTTP/HTTPS) and is designed for multi-region load balancing and acceleration, not for distributing traffic within a single region. It does not provide URL path-based routing to backend pools within the same region.
★ When this WOULD be the correct answer
A company has a web application deployed in multiple Azure regions and needs global load balancing, TLS termination at the edge, and URL path-based routing to different regional backends. Azure Front Door would be the correct choice for this multi-region scenario.
Why candidates choose this
Candidates may confuse Azure Front Door with Application Gateway because both offer TLS termination and URL path-based routing, but Front Door is a global service, while Application Gateway is regional.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Azure Application Gateway
Azure Application Gateway is a cloud-based web traffic load balancer that manages and protects HTTP and HTTPS requests to web applications based on their URL paths and other routing rules.
Key term
Region
A region is a distinct geographic location where a cloud provider operates multiple data centers that are connected by low-latency networks and provide cloud services.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.