AZ-900 Describe Azure architecture and services Practice Question
A global retail company hosts its e-commerce web application on Azure virtual machines in three Azure regions: West Europe, East US, and Southeast Asia. The application must provide a single HTTPS entry point for customers worldwide. The company requires the solution to: route each user to the region that provides the best performance (lowest latency), automatically redirect traffic to a healthy region if one becomes unavailable, and protect the application from common web vulnerabilities such as SQL injection and cross-site scripting (XSS) by inspecting all incoming HTTP/HTTPS traffic at the edge. Which Azure service should the company use?
⚠ Common exam trap
Watch out — candidates often confuse Azure Traffic Manager (DNS-level, no WAF) with Azure Front Door (HTTP/HTTPS edge service with WAF), leading candidates to choose Traffic Manager when the question explicitly requires web vulnerability inspection at the edge.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Front Door
Azure Front Door is the correct choice because it provides global HTTP(S) load balancing with latency-based routing to the nearest region, automatic failover across regions, and built-in Web Application Firewall (WAF) at the edge to inspect all incoming traffic for SQL injection and XSS. This single service meets all three requirements—performance routing, regional failover, and edge-level web vulnerability protection—without needing additional components.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Traffic Manager with a Web Application Firewall (WAF) policy applied to each backend virtual machine
Why it's wrong here
Azure Traffic Manager is a DNS-based traffic routing service that directs traffic to different endpoints based on routing methods such as performance (latency), but it does not inspect HTTP/HTTPS traffic because it operates at the DNS layer. A WAF policy applied at the backend VMs would still not inspect traffic at the edge before it reaches the VMs, and managing per-VM WAF policies would be inefficient.
When this WOULD be correct
A company needs global DNS-based traffic routing across multiple regions to distribute load and improve availability, but does not require HTTP/HTTPS inspection or edge security. For example, routing non-web traffic like API calls or UDP traffic where WAF is not needed.
- ✓
Azure Front Door
Why this is correct
Azure Front Door is a global application delivery network that provides intelligent HTTP/HTTPS load balancing, SSL offload, URL-based routing, and latency-based routing to the closest healthy region. It also includes a built-in Web Application Firewall (WAF) that inspects all incoming traffic at the edge, protecting against common web exploits like SQL injection and XSS.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a regional application load balancer that provides HTTP/HTTPS load balancing, SSL termination, and WAF capabilities. However, it is confined to a single Azure region and cannot route traffic globally based on user latency or perform cross-region failover.
When this WOULD be correct
An exam scenario where a company needs a regional web application with SSL termination, URL-based routing, and a WAF to protect against common web vulnerabilities, all within a single Azure region (e.g., deploying a web app in East US with multiple backend pools).
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer operates at layer 4 (TCP/UDP) of the OSI model and cannot inspect or route HTTP/HTTPS traffic based on URL paths, hostnames, or latency. Additionally, it does not include a Web Application Firewall (WAF) and is designed for regional load balancing within a single region.
When this WOULD be correct
A company needs to distribute incoming TCP/UDP traffic across multiple virtual machines in a single region for high availability and scalability, without requiring HTTP-level routing, global load balancing, or web application firewall capabilities.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Front DoorCorrect answer▾
Why this is correct
Azure Front Door is a global application delivery network that provides intelligent HTTP/HTTPS load balancing, SSL offload, URL-based routing, and latency-based routing to the closest healthy region. It also includes a built-in Web Application Firewall (WAF) that inspects all incoming traffic at the edge, protecting against common web exploits like SQL injection and XSS.
✗Azure Traffic Manager with a Web Application Firewall (WAF) policy applied to each backend virtual machineWrong answer — click to see why▾
Why this is wrong here
Azure Traffic Manager only provides DNS-level traffic routing and does not inspect HTTP/HTTPS traffic; applying a WAF policy to each backend VM does not inspect traffic at the edge, failing the requirement to protect against web vulnerabilities at the edge.
★ When this WOULD be the correct answer
A company needs global DNS-based traffic routing across multiple regions to distribute load and improve availability, but does not require HTTP/HTTPS inspection or edge security. For example, routing non-web traffic like API calls or UDP traffic where WAF is not needed.
Why candidates choose this
Candidates may think Traffic Manager plus WAF on VMs meets all requirements, but they overlook that Traffic Manager does not inspect traffic at the edge and WAF on VMs is not a centralized edge solution.
✗Azure Application GatewayWrong answer — click to see why▾
Why this is wrong here
Azure Application Gateway operates as a regional load balancer and cannot provide global routing across multiple Azure regions with automatic failover based on performance. It also does not natively include a global WAF that inspects traffic at the edge for all regions.
★ When this WOULD be the correct answer
An exam scenario where a company needs a regional web application with SSL termination, URL-based routing, and a WAF to protect against common web vulnerabilities, all within a single Azure region (e.g., deploying a web app in East US with multiple backend pools).
Why candidates choose this
Candidates may confuse Application Gateway's built-in WAF capability with the global WAF and routing features of Azure Front Door, assuming a regional service can meet global requirements.
✗Azure Load BalancerWrong answer — click to see why▾
Why this is wrong here
Azure Load Balancer operates at Layer 4 (TCP/UDP) and cannot route based on latency, perform global failover across regions, or inspect HTTP/HTTPS traffic for web vulnerabilities like SQL injection or XSS.
★ When this WOULD be the correct answer
A company needs to distribute incoming TCP/UDP traffic across multiple virtual machines in a single region for high availability and scalability, without requiring HTTP-level routing, global load balancing, or web application firewall capabilities.
Why candidates choose this
Candidates may confuse Azure Load Balancer with a global load balancing solution, overlooking that it is region-bound and lacks Layer 7 features such as WAF and latency-based routing.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Region
A region is a distinct geographic location where a cloud provider operates multiple data centers that are connected by low-latency networks and provide cloud services.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.