AZ-900 Describe Azure architecture and services Practice Question
A global e-commerce company has web applications deployed on Azure virtual machines in the West US and West Europe regions. The company needs a single, global HTTP-based entry point that can perform SSL offloading, route requests based on the URL path (e.g., /api to one backend pool, /images to another), and provide a web application firewall (WAF) to protect against common web attacks. Additionally, the solution must automatically direct users to the closest regional deployment to minimize latency. Which Azure service should the company use?
⚠ Common exam trap
Candidates often confuse Azure Application Gateway (regional, path-based routing with WAF) with Azure Front Door (global, path-based routing with WAF and global load balancing), missing the critical requirement for global traffic distribution and automatic user proximity routing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Front Door
Azure Front Door is the correct choice because it provides a global, HTTP/HTTPS-based entry point with SSL offloading, URL path-based routing to different backend pools, and a built-in web application firewall (WAF). It also uses Anycast-based routing to automatically direct users to the closest regional deployment, minimizing latency.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager is a DNS-based traffic router that directs traffic at the domain level based on routing methods like performance or geographic. It does not inspect HTTP traffic, cannot offload SSL, route based on URL paths, or provide a web application firewall. Therefore, it does not meet the HTTP-level requirements.
When this WOULD be correct
Azure Traffic Manager would be correct if the question required only global DNS-based traffic distribution across endpoints (e.g., directing users to the closest region based on latency or geographic location) without any Layer 7 processing like SSL offloading, path-based routing, or WAF.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a regional Layer 7 load balancer that offers SSL termination, URL-path routing, and WAF. However, it is deployed within a single region and cannot route requests globally or automatically direct users to the closest regional deployment. A separate Application Gateway instance would be needed in each region, which does not provide a single global endpoint.
When this WOULD be correct
A company needs a regional, layer-7 load balancer for HTTP/HTTPS traffic with SSL offloading, URL path-based routing, and WAF capabilities, but does not require global distribution or latency-based routing across multiple regions.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer operates at Layer 4 (TCP/UDP) and distributes traffic solely based on network-level properties. It cannot inspect HTTP headers, perform URL-path routing, offload SSL, or provide WAF capabilities. It is also a regional service, not global.
When this WOULD be correct
A company needs to distribute incoming TCP/UDP traffic across multiple Azure virtual machines in the same region for high availability and low latency, without requiring SSL termination, URL-based routing, or WAF capabilities.
- ✓
Azure Front Door
Why this is correct
Azure Front Door is a global HTTP(S) load balancer that provides SSL offloading, path-based routing, WAF integration, and intelligent traffic routing to the closest available regional backend. It meets all the specified requirements in a single global service.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Front DoorCorrect answer▾
Why this is correct
Azure Front Door is a global HTTP(S) load balancer that provides SSL offloading, path-based routing, WAF integration, and intelligent traffic routing to the closest available regional backend. It meets all the specified requirements in a single global service.
✗Azure Traffic ManagerWrong answer — click to see why▾
Why this is wrong here
Azure Traffic Manager operates at the DNS level and cannot perform SSL offloading, URL path-based routing, or provide a web application firewall (WAF). It only directs traffic based on DNS resolution and health checks, lacking the Layer 7 features required.
★ When this WOULD be the correct answer
Azure Traffic Manager would be correct if the question required only global DNS-based traffic distribution across endpoints (e.g., directing users to the closest region based on latency or geographic location) without any Layer 7 processing like SSL offloading, path-based routing, or WAF.
Why candidates choose this
Candidates may confuse Traffic Manager's global routing capability (e.g., performance-based routing to the closest region) with the need for a global entry point, overlooking that it lacks the necessary Layer 7 features like SSL offloading, URL path routing, and WAF.
✗Azure Application GatewayWrong answer — click to see why▾
Why this is wrong here
Azure Application Gateway operates at the regional level and cannot provide global load balancing with automatic user routing to the closest regional deployment. It also lacks a single global HTTP endpoint.
★ When this WOULD be the correct answer
A company needs a regional, layer-7 load balancer for HTTP/HTTPS traffic with SSL offloading, URL path-based routing, and WAF capabilities, but does not require global distribution or latency-based routing across multiple regions.
Why candidates choose this
Candidates may confuse Application Gateway's layer-7 features (SSL offloading, URL routing, WAF) with the global capabilities of Azure Front Door, overlooking the requirement for a single global entry point and automatic regional proximity routing.
✗Azure Load BalancerWrong answer — click to see why▾
Why this is wrong here
Azure Load Balancer operates at Layer 4 (TCP/UDP) and cannot perform SSL offloading, URL path-based routing, or provide a web application firewall (WAF). It also does not offer global routing based on user proximity.
★ When this WOULD be the correct answer
A company needs to distribute incoming TCP/UDP traffic across multiple Azure virtual machines in the same region for high availability and low latency, without requiring SSL termination, URL-based routing, or WAF capabilities.
Why candidates choose this
Candidates may confuse Azure Load Balancer with Azure Front Door because both distribute traffic, but they operate at different OSI layers and have different feature sets, leading to incorrect selection when global, Layer 7 features are required.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.