AZ-900 Describe Azure architecture and services Practice Question
A multinational e-commerce company runs its customer-facing web application on Azure virtual machines deployed in two Azure regions: East US and West Europe. The company wants to automatically route user traffic to the nearest regional deployment based on the user's geographic location. Additionally, if one region becomes unavailable, all traffic should automatically be redirected to the remaining healthy region. The company wants a solution that works at the DNS level and does not require terminating HTTPS traffic at the routing layer. Which Azure service should they use?
⚠ Common exam trap
Watch out — candidates often confuse Azure Traffic Manager (DNS-level, global, no SSL termination) with Azure Front Door (global, but terminates SSL at the edge), leading them to pick Front Door because it also supports geographic routing, but they overlook the explicit requirement to avoid HTTPS termination at the routing layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Traffic Manager
Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming DNS requests to the nearest available endpoint based on geographic location (using the Performance traffic-routing method) and automatically fails over to the next healthy region when a region becomes unavailable. It operates at the DNS level, so it does not terminate HTTPS traffic, meeting the requirement to avoid SSL/TLS termination at the routing layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer distributes traffic within a single Azure region and does not provide global geographic routing or cross-region failover. It operates at the transport layer (TCP/UDP) and is not suitable for this multi-region requirement.
When this WOULD be correct
An exam question where a company needs to distribute incoming traffic among virtual machines in the same Azure region for high availability and scalability, without requiring geographic routing or cross-region failover. For example, a web application running on multiple VMs in a single region needing load balancing.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a regional Layer 7 load balancer that routes HTTP(S) traffic within a single Azure region, offering capabilities like URL-based routing, SSL termination, and Web Application Firewall (WAF). It does not use DNS-level routing to resolve user requests to the nearest regional endpoint, nor does it support active-passive or active-active failover across multiple regions. This makes it unsuitable for the global, multi-region failover requirement, as it would require deploying and manually managing separate instances in each region without automatic geographic steering.
When this WOULD be correct
A company needs to route HTTP/HTTPS traffic to a web application based on URL path or host headers, and requires SSL termination, Web Application Firewall (WAF), and session affinity at the application layer. The solution should operate at layer 7 and terminate HTTPS traffic.
- ✓
Azure Traffic Manager
Why this is correct
Azure Traffic Manager is a DNS-based traffic routing service that can direct users to the closest or most appropriate regional endpoint based on geographic location, latency, or priority. It automatically detects endpoint health and fails over to healthy endpoints, making it ideal for global load balancing with DNS-level routing and without terminating HTTPS.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is incorrect because it operates at Layer 7 (HTTP/HTTPS) and requires SSL termination at the edge, directly contradicting the requirement for a DNS-level solution that avoids HTTPS termination at the routing layer. It is tempting as it provides global, latency-based routing and automatic failover for web applications, making it suitable for scenarios where application acceleration, WAF, and SSL offloading at the edge are desired for global web traffic.
When this WOULD be correct
A company needs global load balancing with SSL offloading, web application firewall (WAF), and URL-based routing for an HTTP/HTTPS application. The solution must terminate HTTPS at the edge and provide advanced traffic acceleration.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Traffic ManagerCorrect answer▾
Why this is correct
Azure Traffic Manager is a DNS-based traffic routing service that can direct users to the closest or most appropriate regional endpoint based on geographic location, latency, or priority. It automatically detects endpoint health and fails over to healthy endpoints, making it ideal for global load balancing with DNS-level routing and without terminating HTTPS.
✗Azure Load BalancerWrong answer — click to see why▾
Why this is wrong here
Azure Load Balancer operates at Layer 4 and distributes traffic within a single region, not across multiple regions. It cannot route based on geographic location or perform DNS-level global load balancing with automatic failover between regions.
★ When this WOULD be the correct answer
An exam question where a company needs to distribute incoming traffic among virtual machines in the same Azure region for high availability and scalability, without requiring geographic routing or cross-region failover. For example, a web application running on multiple VMs in a single region needing load balancing.
Why candidates choose this
Candidates may confuse Azure Load Balancer with a global load balancing solution because its name suggests load distribution, but they overlook that it is region-scoped and does not support geographic routing or DNS-level failover across regions.
✗Azure Application GatewayWrong answer — click to see why▾
Why this is wrong here
Azure Application Gateway is a layer 7 load balancer that terminates HTTPS traffic and requires the routing layer to handle SSL/TLS, which contradicts the requirement of not terminating HTTPS at the routing layer. It also does not provide DNS-level geographic traffic routing based on user location.
★ When this WOULD be the correct answer
A company needs to route HTTP/HTTPS traffic to a web application based on URL path or host headers, and requires SSL termination, Web Application Firewall (WAF), and session affinity at the application layer. The solution should operate at layer 7 and terminate HTTPS traffic.
Why candidates choose this
Candidates may confuse Application Gateway's layer 7 capabilities (like URL-based routing) with the geographic routing needed for this scenario, or mistakenly think it can handle DNS-level traffic distribution without terminating HTTPS.
✗Azure Front DoorWrong answer — click to see why▾
Why this is wrong here
Azure Front Door terminates HTTPS traffic at the routing layer, which the question explicitly prohibits. It also provides global load balancing with HTTP/HTTPS traffic optimization, but the requirement is for DNS-level routing without TLS termination.
★ When this WOULD be the correct answer
A company needs global load balancing with SSL offloading, web application firewall (WAF), and URL-based routing for an HTTP/HTTPS application. The solution must terminate HTTPS at the edge and provide advanced traffic acceleration.
Why candidates choose this
Candidates confuse Azure Front Door's global routing capabilities with Traffic Manager's DNS-level routing, and overlook the explicit constraint against HTTPS termination in the question.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Azure Traffic Manager
Azure Traffic Manager is a DNS-based traffic load balancer that directs incoming web traffic to the most appropriate endpoint based on performance, priority, geographic location, or a weighted distribution method.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.