- A
Azure Traffic Manager
Why wrong: Traffic Manager provides DNS-based routing and failover but does not include WAF or HTTP-level features.
- B
Azure Front Door
Front Door provides global load balancing, geographic routing, failover, and integrated WAF.
- C
Azure Application Gateway
Why wrong: Application Gateway is a regional load balancer with WAF, not global.
- D
Azure Load Balancer
Why wrong: Load Balancer is a regional layer 4 load balancer without WAF or geographic routing.
Question 144 of 1,031
Azure Front Door: Global Load Balancing with Integrated WAF and Failover
This AZ-900 practice question tests your understanding of describe azure architecture and services. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A global e-commerce platform runs on Azure App Service in multiple regions. They need to route user traffic to the nearest region based on geographic location, and also provide automatic failover if a region becomes unavailable. Which Azure service includes these capabilities with integrated Web Application Firewall (WAF)?
Quick Answer
The answer is Azure Front Door. This service is the correct choice because it provides global load balancing with integrated WAF and failover by routing user traffic to the nearest Azure region based on geographic location and latency, while automatically redirecting requests if a region becomes unavailable. On the Microsoft Azure Fundamentals AZ-900 exam, this scenario tests your understanding of Azure’s global networking services, often contrasting Azure Front Door with Azure Traffic Manager or Application Gateway. A common trap is choosing Traffic Manager, which also offers geographic routing and failover but lacks native Web Application Firewall (WAF) integration; Azure Front Door combines both at the edge. Remember the memory tip: “Front Door guards the front with WAF and fails over fast.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Front Door
Azure Front Door is a global, scalable entry point that uses the Microsoft global edge network to route user traffic to the nearest region based on geographic location (latency-based routing) and provides automatic failover across regions. It natively integrates Web Application Firewall (WAF) at the edge, protecting against common web exploits like SQL injection and cross-site scripting, making it the correct choice for this scenario.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Traffic Manager
Why it's wrong here
Traffic Manager provides DNS-based routing and failover but does not include WAF or HTTP-level features.
When this WOULD be correct
A question asking for a DNS-level traffic routing service to distribute traffic across multiple regions based on performance or priority, without requiring WAF or application-layer protection, would make Traffic Manager the correct answer.
- ✓
Azure Front Door
Why this is correct
Front Door provides global load balancing, geographic routing, failover, and integrated WAF.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Azure Application Gateway
Why it's wrong here
Application Gateway is a regional load balancer with WAF, not global.
When this WOULD be correct
An exam question asking for a regional web traffic load balancer with integrated WAF and SSL termination for a single-region application, where the requirement is to distribute traffic across backend servers within that region.
- ✗
Azure Load Balancer
Why it's wrong here
Load Balancer is a regional layer 4 load balancer without WAF or geographic routing.
When this WOULD be correct
A question asking for a service to distribute incoming traffic among virtual machines in the same region for high availability, with no need for geographic routing or WAF. For example: 'You need to distribute traffic across multiple VMs in a single Azure region to ensure application availability. Which service should you use?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Front DoorCorrect answer▾
Why this is correct
Front Door provides global load balancing, geographic routing, failover, and integrated WAF.
✗Azure Traffic ManagerWrong answer — click to see why▾
Why this is wrong here
Azure Traffic Manager provides DNS-based traffic routing and failover but lacks integrated Web Application Firewall (WAF) capabilities, which the question explicitly requires.
★ When this WOULD be the correct answer
A question asking for a DNS-level traffic routing service to distribute traffic across multiple regions based on performance or priority, without requiring WAF or application-layer protection, would make Traffic Manager the correct answer.
Why candidates choose this
Candidates may associate Traffic Manager with geographic routing and failover, overlooking the specific requirement for integrated WAF, which is a key differentiator for Front Door.
✗Azure Application GatewayWrong answer — click to see why▾
Why this is wrong here
Azure Application Gateway provides regional load balancing with WAF, but it does not offer multi-region geographic routing or automatic global failover; it operates within a single region.
★ When this WOULD be the correct answer
An exam question asking for a regional web traffic load balancer with integrated WAF and SSL termination for a single-region application, where the requirement is to distribute traffic across backend servers within that region.
Why candidates choose this
Candidates may confuse Application Gateway's WAF and load balancing capabilities with the global routing and failover features of Azure Front Door, assuming Application Gateway can also handle multi-region traffic.
✗Azure Load BalancerWrong answer — click to see why▾
Why this is wrong here
Azure Load Balancer operates at Layer 4 (TCP/UDP) and does not provide geographic routing, automatic failover across regions, or integrated WAF. It is designed for distributing traffic within a single region, not global traffic management.
★ When this WOULD be the correct answer
A question asking for a service to distribute incoming traffic among virtual machines in the same region for high availability, with no need for geographic routing or WAF. For example: 'You need to distribute traffic across multiple VMs in a single Azure region to ensure application availability. Which service should you use?'
Why candidates choose this
Candidates may confuse Azure Load Balancer with Azure Front Door because both can distribute traffic and provide high availability, but they overlook that Load Balancer lacks global routing, geographic-based distribution, and integrated WAF.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse Azure Traffic Manager's DNS-based global routing with Azure Front Door's application-layer global routing and WAF integration, assuming Traffic Manager can also provide WAF protection, which it cannot.
Detailed technical explanation
How to think about this question
Azure Front Door uses Anycast protocol to route traffic to the nearest point of presence (PoP) on the Microsoft global network, enabling sub-50ms failover via health probes. Its WAF policies can be configured with custom rules and managed rule sets (e.g., OWASP 3.2) to filter malicious traffic before it reaches the origin. In a real-world scenario, if a primary region's App Service becomes unhealthy, Front Door automatically reroutes traffic to the next closest healthy region without DNS propagation delays.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Describe Azure architecture and services — study guide chapter
Learn the concepts, then practise the questions
- →
Describe Azure architecture and services practice questions
Targeted practice on this topic area only
- →
All AZ-900 questions
1,031 questions across all exam domains
- →
Microsoft Azure Fundamentals AZ-900 study guide
Full concept coverage aligned to exam objectives
- →
AZ-900 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related AZ-900 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Describe cloud concepts practice questions
Practise AZ-900 questions linked to Describe cloud concepts.
Describe Azure architecture and services practice questions
Practise AZ-900 questions linked to Describe Azure architecture and services.
Describe Azure management and governance practice questions
Practise AZ-900 questions linked to Describe Azure management and governance.
AZ-900 Azure services practice questions
Practise AZ-900 questions linked to AZ-900 Azure services.
AZ-900 pricing and support practice questions
Practise AZ-900 questions linked to AZ-900 pricing and support.
AZ-900 security and compliance practice questions
Practise AZ-900 questions linked to AZ-900 security and compliance.
AZ-900 governance practice questions
Practise AZ-900 questions linked to AZ-900 governance.
Practice this exam
Start a free AZ-900 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this AZ-900 question test?
Describe Azure architecture and services — This question tests Describe Azure architecture and services — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Azure Front Door — Azure Front Door is a global, scalable entry point that uses the Microsoft global edge network to route user traffic to the nearest region based on geographic location (latency-based routing) and provides automatic failover across regions. It natively integrates Web Application Firewall (WAF) at the edge, protecting against common web exploits like SQL injection and cross-site scripting, making it the correct choice for this scenario.
What should I do if I get this AZ-900 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More AZ-900 practice questions
- A company uses Azure and wants to organize all their virtual machines, databases, and storage accounts into logical cont…
- A company uses multiple Azure subscriptions for different departments. The finance team wants to monitor spending across…
- A company wants to ensure that all Azure resources are tagged with a 'CostCenter' tag at creation time. If a resource is…
- A company uses Azure Blueprints to define a repeatable set of Azure resources and policies for new subscriptions. They w…
- A company uses Azure Policy to enforce governance. They want to prevent users from creating virtual machines of the Stan…
- A company wants to ensure that all Azure resources are tagged with metadata such as 'Environment' and 'Department'. They…
Last reviewed: Jun 11, 2026
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.