AZ-900 Describe Azure architecture and services Practice Question
Which Azure service provides a globally distributed content delivery network with DDoS protection and Web Application Firewall capabilities?
⚠ Common exam trap
Candidates often confuse Azure Front Door with Azure CDN or Application Gateway, not realizing that Front Door uniquely combines global CDN, WAF, and DDoS protection in a single service, whereas the others are either regional or lack integrated security features.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Front Door
Azure Front Door is a global, scalable entry point that provides a content delivery network (CDN) with built-in DDoS protection and Web Application Firewall (WAF) capabilities. It operates at Layer 7 (HTTP/HTTPS) and uses Microsoft's global edge network to accelerate and secure web applications. Unlike a standard CDN, Front Door integrates intelligent traffic routing, SSL termination, and application-layer security in a single service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure CDN with WAF
Why it's wrong here
Azure CDN with WAF only delivers cached content, such as static files, from edge nodes; it does not perform global load balancing among multiple origins based on health or latency. While you can add WAF via policy, it lacks Front Door's built-in intelligent routing, session affinity, and instant automatic failover across backend pools. Front Door converges content delivery, global routing, WAF, and DDoS into a single service, whereas CDN remains primarily a content distribution and acceleration layer.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a regional, layer-7 HTTP/HTTPS load balancer operating within a single Azure region. It provides cookie-based session affinity, URL path-based routing, and a Web Application Firewall (WAF) to protect regional services. However, it cannot route traffic across multiple regions or provide the global anycast edge capabilities of Azure Front Door, which is why it fails to meet the requirement for a global, edge-based solution with native WAF and DDoS protection.
- ✓
Azure Front Door
Why this is correct
Azure Front Door is a global, scalable entry point built on Microsoft's edge network, using anycast to route user traffic to the nearest healthy backend. It provides global load balancing, instant failover, URL-based routing, SSL offload, caching, and integrated WAF and DDoS protection at the edge. Unlike regional offerings, Front Door operates at the network edge across hundreds of POPs, ensuring low latency and high availability for internet-facing applications, making it the correct choice.
- ✗
Azure DDoS Protection Standard
Why it's wrong here
Azure DDoS Protection Standard is a dedicated security service that always-on monitors and mitigates volumetric DDoS attacks against public IP addresses and virtual networks. It does not route traffic, balance load across regions, or cache content; it focuses solely on network-layer and application-layer attack mitigation. Front Door also provides DDoS protection but at the edge, and combines it with global load balancing and WAF, offering a broader, more complete solution for a global environment.
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Edge network
An edge network is a distributed computing architecture that brings data processing and storage closer to the physical location where data is generated, rather than relying on a central data center.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.