AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Application Gateway

  Why it's wrong here

  Azure Application Gateway is wrong because it is a Layer 7 load balancer that routes HTTP/HTTPS requests based on URL paths, host headers, cookies, and other application-level attributes. It supports SSL termination and session affinity, but it does not forward arbitrary TCP/UDP packets like a Layer 4 load balancer. For a straightforward web application on VMs needing basic traffic spread, Application Gateway's web-specific features add complexity without the raw, protocol-agnostic forwarding that Azure Load Balancer provides.

  When this WOULD be correct

  A company needs to route HTTP traffic based on URL path or host headers, and also requires SSL termination and Web Application Firewall (WAF) capabilities. In that case, Azure Application Gateway would be the correct choice.

• ✗

  Azure Front Door

  Why it's wrong here

  Azure Front Door is wrong because it is a global Layer 7 application delivery controller that only handles HTTP/HTTPS traffic. It terminates client connections at the edge and opens new connections to backends, offering features like WAF, SSL offloading, and URL-based routing. This makes it unsuitable for raw network-level traffic distribution, as it introduces proxy processing overhead and protocol restrictions that are unnecessary for simply spreading traffic across VMs.

  When this WOULD be correct

  A company has a global web application deployed across multiple Azure regions and wants to provide low-latency access and high availability by routing users to the nearest region. Azure Front Door would be the correct choice for global HTTP/HTTPS load balancing and web application protection.

• ✗

  Azure Traffic Manager

  Why it's wrong here

  Azure Traffic Manager is wrong because it functions at the DNS level, resolving domain names to regional endpoints based on policies like performance or priority. Once a client receives an IP address, Traffic Manager is completely out of the connection path, so it cannot distribute individual connections across VMs or react to a VM failure mid-session. For a single-region VM workload, this adds unnecessary DNS overhead and fails to provide the direct, per-connection load balancing needed.

  When this WOULD be correct

  A company has web applications deployed in multiple Azure regions and wants to route user traffic to the closest region for low latency or to provide disaster recovery failover. In that scenario, Azure Traffic Manager would be the correct choice.

• ✓

  Azure Load Balancer

  Why this is correct

  Azure Load Balancer is correct because it operates at OSI Layer 4, distributing raw TCP and UDP traffic directly to backend VMs without inspecting packet payloads. This provides low-latency, high-throughput load balancing for any protocol, making it ideal for spreading incoming network connections across multiple VMs in a single region. Health probes ensure traffic is sent only to healthy VMs, giving simple and efficient per-connection distribution.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question