AZ-900 Describe Azure architecture and services Practice Question
A company has a global web application deployed on Azure virtual machines in three separate Azure regions: West US, West Europe, and Southeast Asia. The application must automatically direct each user to the region that is geographically closest to the user's location in order to minimize latency. The solution must expose a single DNS name that does not change if regions are added or removed. The company does not need to offload SSL certificates or perform URL-based routing at the global level. Which Azure service should the company use to meet these requirements?
⚠ Common exam trap
It's easy for candidates to confuse Azure Traffic Manager (DNS-based, Layer 4) with Azure Front Door (Layer 7, HTTP/HTTPS), and choose Front Door because it also supports global routing, but the question explicitly states no SSL offload or URL-based routing is needed, making Traffic Manager the correct and simpler choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Traffic Manager
Azure Traffic Manager is a DNS-based traffic load balancer that can route users to the closest regional endpoint based on geographic location using the 'Performance' routing method. It exposes a single DNS name (e.g., myapp.trafficmanager.net) that remains constant even when endpoints are added or removed, and it does not require SSL offloading or URL-based routing, matching the requirements exactly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer distributes incoming traffic across healthy virtual machines within a single region at the transport layer (Layer 4). It cannot route traffic across multiple Azure regions based on geographic location, and it does not provide a single DNS name that points to multiple regions.
When this WOULD be correct
A company needs to distribute incoming traffic among multiple virtual machines in the same Azure region for high availability and load balancing, without global routing requirements.
- ✓
Azure Traffic Manager
Why this is correct
Azure Traffic Manager is a DNS-based traffic routing service that can direct users to the closest region using performance or geographic routing methods. It exposes a single DNS name, supports multi-region failover, and does not require SSL offloading or URL routing, making it the correct choice for this scenario.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a regional Layer 7 load balancer that provides HTTP/S routing, SSL termination, and Web Application Firewall (WAF) capabilities. It operates within a single region and is not designed for global DNS-based geographic routing across multiple regions.
When this WOULD be correct
A company needs to load balance HTTP/HTTPS traffic across multiple virtual machines within a single Azure region, with features like SSL termination, URL path-based routing, and Web Application Firewall (WAF) capabilities.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is incorrect because the scenario explicitly states there is no need to offload SSL certificates or perform URL-based routing at the global level. While Front Door provides latency-based routing and a single DNS name, its primary value lies in its advanced Layer 7 capabilities, such as SSL termination, Web Application Firewall, and URL path-based routing. It would be the correct choice if these advanced features were required, as it leverages Microsoft's global edge network for enhanced performance and security for web applications.
When this WOULD be correct
A company needs a global web application with automatic failover, SSL offload, and URL path-based routing (e.g., /images to one backend, /api to another). They also require Web Application Firewall (WAF) protection. In that scenario, Azure Front Door would be the correct choice.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Traffic ManagerCorrect answer▾
Why this is correct
Azure Traffic Manager is a DNS-based traffic routing service that can direct users to the closest region using performance or geographic routing methods. It exposes a single DNS name, supports multi-region failover, and does not require SSL offloading or URL routing, making it the correct choice for this scenario.
✗Azure Load BalancerWrong answer — click to see why▾
Why this is wrong here
Azure Load Balancer distributes traffic within a single region and does not provide global DNS-based routing to the closest region based on user location.
★ When this WOULD be the correct answer
A company needs to distribute incoming traffic among multiple virtual machines in the same Azure region for high availability and load balancing, without global routing requirements.
Why candidates choose this
Candidates may confuse load balancing with global traffic routing, assuming Load Balancer can direct users to different regions when it only operates regionally.
✗Azure Application GatewayWrong answer — click to see why▾
Why this is wrong here
Azure Application Gateway is a regional load balancer that operates at Layer 7 (HTTP/HTTPS) and supports URL-based routing and SSL offloading, but it does not provide global traffic routing based on geographic proximity or a single DNS name that remains unchanged when regions are added or removed.
★ When this WOULD be the correct answer
A company needs to load balance HTTP/HTTPS traffic across multiple virtual machines within a single Azure region, with features like SSL termination, URL path-based routing, and Web Application Firewall (WAF) capabilities.
Why candidates choose this
Candidates may confuse Application Gateway's Layer 7 capabilities (like HTTP routing) with global traffic management, or assume that any 'gateway' service can handle multi-region routing.
✗Azure Front DoorWrong answer — click to see why▾
Why this is wrong here
Azure Front Door provides global load balancing with SSL offload and URL-based routing, but the question explicitly states no need for SSL offload or URL-based routing. Traffic Manager is the simpler DNS-based service that meets the requirement of directing users to the closest region without those features.
★ When this WOULD be the correct answer
A company needs a global web application with automatic failover, SSL offload, and URL path-based routing (e.g., /images to one backend, /api to another). They also require Web Application Firewall (WAF) protection. In that scenario, Azure Front Door would be the correct choice.
Why candidates choose this
Candidates may confuse Azure Front Door with Traffic Manager because both provide global load balancing and traffic routing based on proximity. They might assume Front Door is always the better option without reading the specific requirements about SSL offload and URL routing.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Region
A region is a distinct geographic location where a cloud provider operates multiple data centers that are connected by low-latency networks and provide cloud services.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.