AZ-900 Describe Azure architecture and services Practice Question
A company runs a web application on Azure App Service. They want to route users to the nearest regional deployment based on DNS queries to minimize latency. Which Azure service should they use for this global traffic routing?
⚠ Common exam trap
Many candidates confuse Traffic Manager's DNS-level global routing with regional load balancers like Azure Load Balancer or Application Gateway, mistakenly thinking they can handle multi-region traffic distribution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Traffic Manager
Traffic Manager is a DNS-based traffic load balancer that routes incoming DNS queries to the nearest regional endpoint based on the user's geographic location, network latency, or other routing methods. This ensures users are directed to the closest Azure App Service deployment, minimizing latency for global traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer works at Layer 4 of the OSI model, distributing TCP/UDP traffic across virtual machines in a single region. It is not global and cannot make routing decisions based on DNS or HTTP characteristics. It simply forwards packets to healthy backend endpoints within the same region, so it cannot satisfy a requirement for global routing across regions.
When this WOULD be correct
A company runs a stateless web application on multiple VMs in the same Azure region and needs to distribute incoming traffic evenly across those VMs for high availability and scalability.
- ✗
Application Gateway
Why it's wrong here
Application Gateway is a regional Layer 7 load balancer that operates at the HTTP/HTTPS protocol level, offering features like SSL termination, URL-based routing, and web application firewall (WAF). However, it is deployed within a single Azure region and cannot route traffic globally across multiple regions. Its scope is limited to balancing traffic among backend resources in that same region, making it unsuitable for global traffic management.
When this WOULD be correct
A company needs to route and load balance HTTP traffic to a web application within a single Azure region, with features like SSL termination, URL-based routing, and Web Application Firewall (WAF).
- ✓
Traffic Manager
Why this is correct
Traffic Manager is a DNS-based global traffic routing service that directs client requests to the most appropriate endpoint across Azure regions. It operates at the DNS level, using policies such as performance, priority, weighted, or geographic routing to respond with the best available endpoint's IP address. Because it does not inspect HTTP traffic, it is the simplest and most direct solution for routing a global web application based on DNS queries alone.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is also a global load balancer, but it operates at HTTP/HTTPS level and provides more features than Traffic Manager. For a simple DNS-based routing requirement, Traffic Manager is the more direct answer.
When this WOULD be correct
A company runs a web application on Azure App Service and needs global load balancing with HTTP/HTTPS traffic acceleration, SSL offload, and web application firewall (WAF) capabilities. They want to route users to the nearest regional deployment based on latency and provide fast failover. In this scenario, Azure Front Door would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Traffic ManagerCorrect answer▾
Why this is correct
Traffic Manager is a DNS-based global traffic routing service that directs client requests to the most appropriate endpoint across Azure regions. It operates at the DNS level, using policies such as performance, priority, weighted, or geographic routing to respond with the best available endpoint's IP address. Because it does not inspect HTTP traffic, it is the simplest and most direct solution for routing a global web application based on DNS queries alone.
✗Azure Load BalancerWrong answer — click to see why▾
Why this is wrong here
Azure Load Balancer distributes traffic within a single Azure region at the transport layer (OSI layer 4), not based on DNS queries or geographic proximity of users.
★ When this WOULD be the correct answer
A company runs a stateless web application on multiple VMs in the same Azure region and needs to distribute incoming traffic evenly across those VMs for high availability and scalability.
Why candidates choose this
Candidates may confuse 'load balancing' with 'global traffic routing' because both involve distributing traffic, but they operate at different layers and scopes.
✗Application GatewayWrong answer — click to see why▾
Why this is wrong here
Application Gateway is a regional layer 7 load balancer that routes traffic based on HTTP rules, not DNS-based geographic proximity. It cannot route users to the nearest regional deployment globally based on DNS queries.
★ When this WOULD be the correct answer
A company needs to route and load balance HTTP traffic to a web application within a single Azure region, with features like SSL termination, URL-based routing, and Web Application Firewall (WAF).
Why candidates choose this
Candidates may confuse Application Gateway's layer 7 capabilities with global routing, assuming it can handle geographic distribution because it operates at the application layer.
✗Azure Front DoorWrong answer — click to see why▾
Why this is wrong here
Azure Front Door is a global load balancer and application delivery controller that works at Layer 7 (HTTP/HTTPS), but the question specifies routing based on DNS queries to minimize latency, which is exactly what Traffic Manager does. Front Door also uses anycast and global routing, but it is designed for HTTP/HTTPS traffic and provides additional features like SSL offload and WAF, not just DNS-based routing.
★ When this WOULD be the correct answer
A company runs a web application on Azure App Service and needs global load balancing with HTTP/HTTPS traffic acceleration, SSL offload, and web application firewall (WAF) capabilities. They want to route users to the nearest regional deployment based on latency and provide fast failover. In this scenario, Azure Front Door would be the correct answer.
Why candidates choose this
Candidates may confuse Azure Front Door with Traffic Manager because both provide global routing and can direct users to the nearest region. They might think Front Door is the more advanced service for global traffic, but the question specifically asks for DNS-based routing, which is Traffic Manager's core function.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Azure App Service
Azure App Service is a fully managed platform for building, deploying, and scaling web applications and APIs without managing the underlying infrastructure.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.