Match each Azure networking service to its purpose.
Drag a concept onto its matching description — or click a concept then click the description.
Distribute traffic across VMs
Layer 7 load balancer with WAF
DNS-based traffic routing across regions
Send encrypted traffic between networks
Dedicated private connection to Azure
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Azure Load Balancer: Distributes network traffic at the transport layer (layer 4).
Azure Load Balancer operates at layer 4, Application Gateway at layer 7, Traffic Manager at DNS level. The distractors mix these characteristics.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Azure Load Balancer: Distributes network traffic at the transport layer (layer 4).
Why this is correct
Azure Load Balancer operates at OSI layer 4 (transport), forwarding TCP and UDP traffic to healthy backend pool instances based on port and IP information. It performs no inspection of application payloads, making it a high-throughput, low-latency option for non-HTTP workloads or internal services. Because it is not application-aware, features such as SSL termination, URL-based routing, or HTTP header manipulation are outside its scope.
Azure Application Gateway: Load balances web traffic at the application layer (layer 7) with routing and WAF.
Why this is correct
Azure Application Gateway is a layer 7 reverse proxy that understands HTTP/HTTPS traffic, enabling capabilities like URL path-based routing, host header routing, and SSL termination at the gateway. Its integrated Web Application Firewall (WAF) protects against common web exploits such as SQL injection and cross-site scripting. Unlike a layer 4 load balancer, it inspects the full application request to make routing decisions, making it ideal for web applications that require L7 semantics.
Azure Traffic Manager: Directs traffic based on DNS and routing methods like performance or geographic.
Why this is correct
Azure Traffic Manager uses DNS to steer client requests to the most appropriate endpoint across globally distributed regions, rather than inspecting and forwarding individual packets. Its routing methods include performance (lowest latency), geographic, weighted, priority, and multi-value, allowing policies based on user location or failover requirements. Since it operates at the DNS resolution level, it does not see or manage the actual network or transport layer connections after the client receives the endpoint IP.
Azure Load Balancer: Provides SSL termination and URL-based routing.
Why it's wrong here
This statement is incorrect because SSL termination and URL-based routing are application layer (layer 7) responsibilities that Azure Application Gateway handles. Azure Load Balancer works exclusively at layer 4, using information in TCP/UDP headers and IP addresses to distribute traffic; it cannot decrypt, inspect, or route based on HTTP URLs or certificates. Thus, assigning these features to Load Balancer conflates the distinct architectural roles of a transport-layer load balancer and an application-layer gateway.
Azure Application Gateway: Distributes traffic across multiple regions based on DNS.
Why it's wrong here
This statement is incorrect because DNS-based multi-region distribution is exactly what Azure Traffic Manager does, not Application Gateway. An Application Gateway is a regional resource that load balances HTTP/HTTPS traffic among backend pools, such as virtual machines or Azure App Service, typically within the same region. While an Application Gateway can be placed behind a Traffic Manager for global routing, on its own it does not perform DNS-level resolution or route traffic between regions.
Azure Traffic Manager: Manages traffic at the transport layer within a region.
Why it's wrong here
This statement misidentifies Azure Traffic Manager as a transport-layer load balancer; in reality, Traffic Manager operates purely at the DNS level, returning endpoint IP addresses in response to DNS queries. It does not inspect or forward TCP/UDP packets, and it has no knowledge of transport-layer connections once a client contacts the selected endpoint. Transport-layer (layer 4) load balancing within a region is the function of Azure Load Balancer, which forwards traffic to healthy backend instances based on IP and port.
Go deeper
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.