AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Traffic Manager

  Why it's wrong here

  Azure Traffic Manager is a DNS-based global traffic router that directs clients to endpoint IPs based on routing methods (e.g., performance, priority, geographic). It provides global failover and distribution but does not inspect or manipulate HTTP/S traffic, and it does not include a Web Application Firewall (WAF). Because it only returns DNS responses rather than managing actual traffic, it lacks the security and layer 7 features required for an e-commerce platform.

  When this WOULD be correct

  A question asking for a DNS-level traffic routing service to distribute traffic across multiple regions based on performance or priority, without requiring WAF or application-layer protection, would make Traffic Manager the correct answer.

• ✓

  Azure Front Door

  Why this is correct

  Azure Front Door is the correct choice because it is a global, cloud-native entry point (layer 7) that provides HTTP/HTTPS load balancing across regions, geographic routing, automatic failover, and integrated Web Application Firewall (WAF). It uses Microsoft's global edge network with anycast to bring traffic to the nearest region, which is ideal for a global e-commerce platform. Front Door also supports path-based routing, domain acceleration, and TLS offload, making it a comprehensive global delivery solution.

• ✗

  Azure Application Gateway

  Why it's wrong here

  Azure Application Gateway is a regional layer 7 load balancer that operates within a single Azure region. While it includes a Web Application Firewall (WAF) and can route HTTP/S traffic, it cannot perform global load balancing or geographic routing across multiple regions. For a global e-commerce platform, this service would only manage traffic within one region, leaving other regions unserved or requiring separate instances.

  When this WOULD be correct

  An exam question asking for a regional web traffic load balancer with integrated WAF and SSL termination for a single-region application, where the requirement is to distribute traffic across backend servers within that region.

• ✗

  Azure Load Balancer

  Why it's wrong here

  Azure Load Balancer is a regional layer 4 load balancer that distributes TCP/UDP traffic within a virtual network or across availability zones. It operates at the transport layer and does not inspect HTTP/HTTPS headers, lacks an integrated Web Application Firewall (WAF), and cannot perform geographic routing. Thus, it is unsuitable for global web traffic management on an e-commerce platform.

  When this WOULD be correct

  A question asking for a service to distribute incoming traffic among virtual machines in the same region for high availability, with no need for geographic routing or WAF. For example: 'You need to distribute traffic across multiple VMs in a single Azure region to ensure application availability. Which service should you use?'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question