AZ-900 Describe Azure architecture and services Practice Question
An international e-commerce company has deployed its web application in two Azure regions to serve customers globally. The solution must automatically route users to the region with the lowest latency, provide high availability with automatic failover if one region becomes unavailable, and protect the application from common web exploits such as SQL injection and cross-site scripting at the edge. Which Azure service should the company use?
⚠ Common exam trap
Many candidates confuse Azure Traffic Manager (global DNS routing) with Azure Front Door (global HTTP/S routing with WAF), overlooking that Traffic Manager lacks application-layer security and WAF capabilities required for protecting against web exploits.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Front Door
Azure Front Door is a global, scalable entry point that provides HTTP(S) load balancing with latency-based routing, automatic failover across regions, and built-in web application firewall (WAF) protection against common exploits like SQL injection and cross-site scripting. It operates at Layer 7 (application layer) and integrates with Azure WAF policies at the edge, making it the correct choice for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Traffic Manager
Why it's wrong here
Azure Traffic Manager provides DNS-based traffic routing for global distribution and can perform failover, but it operates at the DNS level and does not include a web application firewall (WAF). It cannot inspect HTTPS traffic for exploits, so it does not meet the security requirement.
When this WOULD be correct
An exam question requiring global traffic routing based on latency or geographic location, with automatic failover, but without any mention of web application firewall or protection against application-layer attacks, would make Traffic Manager the correct answer.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer operates at layer 4 (TCP/UDP) and distributes traffic only within a single region. It does not provide global routing based on latency, nor does it include a WAF or any application-layer security features. Therefore, it cannot fulfill the multi-region failover or web exploit protection needs.
When this WOULD be correct
A company deploys a web application in a single Azure region behind multiple virtual machines. They need to distribute incoming traffic evenly across the VMs for high availability and scalability within that region. Azure Load Balancer would be the correct choice.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a regional layer 7 load balancer that supports WAF and HTTP/HTTPS traffic. However, it is designed to distribute traffic within a single region and does not offer the global, latency-based routing and cross-region failover required for the e-commerce company’s worldwide deployment.
When this WOULD be correct
A company deploys a web application in a single Azure region and needs to protect it from web exploits like SQL injection and cross-site scripting, while also performing SSL termination and URL-based routing. Azure Application Gateway with WAF would be the correct choice.
- ✓
Azure Front Door
Why this is correct
Azure Front Door is a global application delivery network that routes HTTP/HTTPS traffic to the nearest region using latency-based routing. It provides automatic failover across regions and includes a built-in web application firewall (WAF) to protect against common exploits at the network edge, making it the correct choice for the company’s requirements.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Front DoorCorrect answer▾
Why this is correct
Azure Front Door is a global application delivery network that routes HTTP/HTTPS traffic to the nearest region using latency-based routing. It provides automatic failover across regions and includes a built-in web application firewall (WAF) to protect against common exploits at the network edge, making it the correct choice for the company’s requirements.
✗Azure Traffic ManagerWrong answer — click to see why▾
Why this is wrong here
Azure Traffic Manager routes traffic based on DNS and latency, but it does not provide application-layer protection against web exploits like SQL injection or cross-site scripting; it lacks the Web Application Firewall (WAF) capabilities required for edge security.
★ When this WOULD be the correct answer
An exam question requiring global traffic routing based on latency or geographic location, with automatic failover, but without any mention of web application firewall or protection against application-layer attacks, would make Traffic Manager the correct answer.
Why candidates choose this
Candidates may confuse Traffic Manager's global DNS-based routing and failover capabilities with the need for edge security, overlooking that Traffic Manager operates at the DNS level and does not inspect HTTP traffic or provide WAF.
✗Azure Load BalancerWrong answer — click to see why▾
Why this is wrong here
Azure Load Balancer operates at Layer 4 (transport layer) and cannot route based on latency, provide global failover across regions, or protect against web exploits like SQL injection and XSS.
★ When this WOULD be the correct answer
A company deploys a web application in a single Azure region behind multiple virtual machines. They need to distribute incoming traffic evenly across the VMs for high availability and scalability within that region. Azure Load Balancer would be the correct choice.
Why candidates choose this
Candidates may confuse load balancing with global traffic routing and failover, assuming Load Balancer can handle multi-region scenarios and application-layer security, which it cannot.
✗Azure Application GatewayWrong answer — click to see why▾
Why this is wrong here
Azure Application Gateway is a regional web traffic load balancer that operates at Layer 7, but it does not provide global routing based on latency or automatic cross-region failover; it is confined to a single Azure region.
★ When this WOULD be the correct answer
A company deploys a web application in a single Azure region and needs to protect it from web exploits like SQL injection and cross-site scripting, while also performing SSL termination and URL-based routing. Azure Application Gateway with WAF would be the correct choice.
Why candidates choose this
Candidates may confuse Application Gateway's Web Application Firewall (WAF) capability with Azure Front Door's global WAF, overlooking that Front Door provides global load balancing and failover across regions, which the question requires.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
High availability
High availability is a system design approach that aims to keep applications and services operational and accessible with minimal downtime, even when some components fail.
Key term
Region
A region is a distinct geographic location where a cloud provider operates multiple data centers that are connected by low-latency networks and provide cloud services.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.