Azure Front Door: Global Routing and DDoS Mitigation
A multinational company runs a web application that must serve users from around the world with low latency. The application is deployed in multiple Azure regions. The company also requires built-in protection against distributed denial-of-service (DDoS) attacks at the network layer. The solution must automatically route users to the closest healthy endpoint based on geographic location. Which Azure service should the company use?
Quick Answer
The answer is Azure Front Door. This service is the correct choice because it combines global load balancing with automatic user routing to the closest healthy endpoint based on geographic location, ensuring low latency for a worldwide user base, while also providing built-in DDoS protection at the network layer (L3/L4) as part of Azure’s infrastructure. On the Microsoft Azure Fundamentals AZ-900 exam, this question tests your understanding of how Azure Front Door differs from regional services like Application Gateway or Traffic Manager; a common trap is confusing it with Azure Traffic Manager, which offers DNS-based routing but lacks integrated DDoS mitigation. Remember that Azure Front Door is the only service that natively bundles global HTTP/S load balancing, latency-based routing, and network-layer DDoS protection into a single solution. A helpful memory tip: think of Front Door as your global front door that both directs traffic to the nearest room and keeps out unwanted visitors at the doorstep.
⚠ Common exam trap
Many exam-takers confuse Azure Traffic Manager's DNS-based global routing with Azure Front Door's Anycast-based global routing, overlooking that Traffic Manager lacks built-in network-layer DDoS protection and that Front Door provides both global routing and integrated DDoS mitigation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Front Door
Azure Front Door is correct because it provides global load balancing with automatic routing to the closest healthy endpoint based on geographic location (latency-based routing), and it includes built-in DDoS protection at the network layer (L3/L4) as part of the Azure infrastructure. This combination of global routing and integrated DDoS mitigation directly matches the requirements for a multinational application serving users worldwide.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager provides DNS-based traffic routing to distribute traffic across regions based on performance, geographic, or priority methods, but it does not include built-in DDoS protection and does not act as a reverse proxy at the application layer.
When this WOULD be correct
A company needs to distribute traffic across multiple endpoints (e.g., on-premises and cloud) based on performance or priority routing, without requiring application-layer features like SSL offload or WAF. For example, a hybrid application using Traffic Manager for failover between Azure and on-premises data centers.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer is a regional, layer 4 load balancer that distributes traffic within a single Azure region. It does not route users to the closest region globally and does not provide built-in DDoS protection at the network layer (only supports DDoS protection if a standard SKU and a DDoS protection plan is enabled separately, but it is not a global service).
When this WOULD be correct
A company deploys a web application in a single Azure region and needs to distribute incoming traffic across multiple virtual machines for high availability and reliability within that region. The solution must operate at the transport layer (TCP/UDP) and support health probes.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a regional layer 7 load balancer with URL-based routing and Web Application Firewall (WAF) capabilities. It does not provide global geographic routing across regions and does not include built-in network-layer DDoS protection.
When this WOULD be correct
A company needs to route HTTP(S) traffic to a web application hosted in a single Azure region, with features like URL-based routing, SSL termination, and a Web Application Firewall (WAF) for application-layer protection.
- ✓
Azure Front Door
Why this is correct
Azure Front Door is a global, scalable entry point that uses Microsoft's global edge network to route users to the nearest healthy application endpoint based on latency or geography. It offers built-in DDoS protection at the network layer (L3/L4) as a standard feature, meeting both requirements.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Front DoorCorrect answer▾
Why this is correct
Azure Front Door is a global, scalable entry point that uses Microsoft's global edge network to route users to the nearest healthy application endpoint based on latency or geography. It offers built-in DDoS protection at the network layer (L3/L4) as a standard feature, meeting both requirements.
✗Azure Traffic ManagerWrong answer — click to see why▾
Why this is wrong here
Azure Traffic Manager routes traffic based on DNS, which does not provide built-in DDoS protection at the network layer, and it lacks integrated WAF and application-layer acceleration features required for global low-latency web applications.
★ When this WOULD be the correct answer
A company needs to distribute traffic across multiple endpoints (e.g., on-premises and cloud) based on performance or priority routing, without requiring application-layer features like SSL offload or WAF. For example, a hybrid application using Traffic Manager for failover between Azure and on-premises data centers.
Why candidates choose this
Candidates may confuse Traffic Manager's geographic routing capability with Front Door's global load balancing, overlooking that Front Door provides integrated DDoS protection and application-layer optimization.
✗Azure Load BalancerWrong answer — click to see why▾
Why this is wrong here
Azure Load Balancer operates at Layer 4 and distributes traffic within a single region, not globally. It lacks geographic routing and built-in DDoS protection at the network layer, which are required for global low-latency access and DDoS mitigation.
★ When this WOULD be the correct answer
A company deploys a web application in a single Azure region and needs to distribute incoming traffic across multiple virtual machines for high availability and reliability within that region. The solution must operate at the transport layer (TCP/UDP) and support health probes.
Why candidates choose this
Candidates may confuse load balancing with global traffic routing, assuming any load balancer can handle geographic distribution. They might also overlook the requirement for built-in DDoS protection, which is not a feature of Azure Load Balancer.
✗Azure Application GatewayWrong answer — click to see why▾
Why this is wrong here
Azure Application Gateway is a regional load balancer for HTTP(S) traffic, but it does not provide global routing based on geographic location or built-in DDoS protection at the network layer; it operates within a single region.
★ When this WOULD be the correct answer
A company needs to route HTTP(S) traffic to a web application hosted in a single Azure region, with features like URL-based routing, SSL termination, and a Web Application Firewall (WAF) for application-layer protection.
Why candidates choose this
Candidates may confuse Application Gateway's WAF and layer-7 capabilities with Front Door's global routing and DDoS protection, or assume any Azure load balancing service includes geographic routing.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A global e-commerce company has web applications deployed on Azure virtual machines in the West US and West Europe regions. The company needs a single, global HTTP-based entry point that can perform SSL offloading, route requests based on the URL path (e.g., /api to one backend pool, /images to another), and provide a web application firewall (WAF) to protect against common web attacks. Additionally, the solution must automatically direct users to the closest regional deployment to minimize latency. Which Azure service should the company use?
medium- A.Azure Traffic Manager
- B.Azure Application Gateway
- C.Azure Load Balancer
- ✓ D.Azure Front Door
Why D: Azure Front Door is the correct choice because it provides a global, HTTP/HTTPS-based entry point with SSL offloading, URL path-based routing to different backend pools, and a built-in web application firewall (WAF). It also uses Anycast-based routing to automatically direct users to the closest regional deployment, minimizing latency.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.