Azure Fundamentals AZ-900 Sign in Try 10 free questions

Azure load balancing: Load Balancer, App Gateway, Front Door

Four Azure services spread traffic — but at different layers and scopes. Seven AZ-900 questions on picking the right one for the routing need, 2026 edition.

Try 7 free Azure load-balancing questions in the exam's own style — every answer explained, no sign-up — part of our 300-question bank.

Straight to the 7 free questions ↓

The one-line verdict: match the service to the layer and the scope. Layer 4 versus layer 7 tells you whether it reads the request; regional versus global tells you whether it spreads traffic inside a region or chooses a region. Get those two axes right and every AZ-900 load-balancing question falls into place.

Four services, two questions each

Azure has four traffic-distribution services, and beginners blur them because they all “balance load.” The diagram above sorts them on the two axes that actually separate them — layer (how deep it looks) and scope (regional or global).

  • Azure Load Balancer — layer 4, TCP/UDP. It spreads incoming traffic evenly across VMs inside one region, deciding on IP and port alone. It never reads the URL, which makes it fast and protocol-agnostic.
  • Application Gateway — layer 7, HTTP/HTTPS. Still regional, but it reads the request, so it can route by URL path or hostname and add a built-in web application firewall (WAF).
  • Azure Front Door — global, layer 7. A single global entry point that terminates HTTPS, caches content like a CDN, runs a WAF at the edge, and routes each user to the nearest healthy region.
  • Traffic Manager — global, DNS-based. It routes by geography, priority, or performance and can point to any endpoint, but it only returns a DNS answer — the traffic itself never passes through it.

Read the layer

Layer 4 versus layer 7 is the first split the exam tests. A layer-4 service (Load Balancer) sees only IP and port, so it works for any protocol — a database port, a game server, a custom TCP service. A layer-7 service (Application Gateway, Front Door) reads the HTTP request, so it can make decisions on the path (/api versus /images), the hostname, or headers, and it can defend the app with a WAF. If a scenario mentions URLs, paths, hostnames, or a firewall for web traffic, you are in layer-7 territory.

Read the scope

The second split is regional versus global. Load Balancer and Application Gateway live inside one region — they spread traffic across the VMs there. Front Door and Traffic Manager are global — they decide which region a user should reach. That is why real multi-region designs pair them: a global service picks the region, and a regional load balancer spreads the traffic once inside it. The exam almost always slips in a “both” answer for exactly this pattern.

Front Door and Traffic Manager are the pair students confuse most. Both route globally, but Front Door is a layer-7 HTTP edge with caching and WAF, while Traffic Manager is pure DNS that can route any protocol to any endpoint. Front Door carries and accelerates your web traffic; Traffic Manager just answers the DNS lookup and steps aside.

The shortcut to carry in

Answer each question below before revealing the explanation, and when you miss, read past the correct option to why the distractors are wrong — they are usually the right tool aimed at the wrong layer or scope. One hook does most of the work:

Layer 4 = IP + port. Layer 7 = reads the URL. Regional = spread inside; global = pick the region.

The real exam mixes multiple-choice, true/false, and drag-and-drop, but the reasoning is the same every time. For the network foundations underneath these services, see virtual network and subnets, the wider architecture and services domain, and hybrid connectivity.

Four columns comparing Azure traffic-distribution services by layer and scope. Two regional columns on the left: Azure Load Balancer, layer 4, TCP and UDP, spreads traffic evenly across VMs inside one region with no content awareness; and Application Gateway, layer 7 HTTP and HTTPS, routes by URL path or hostname within a region and offers a built-in web application firewall. Two global columns on the right: Azure Front Door, global layer 7, a global entry point with CDN caching and WAF at the edge that routes to the nearest healthy region; and Traffic Manager, DNS-based and global, routes to any endpoint by geography, priority or performance and only returns a DNS answer so no traffic passes through it. A caption explains layer 4 uses IP and port only while layer 7 reads the HTTP request, and that global services choose the region while regional services spread traffic inside it.

7 free AZ-900 practice questions

Answers and explanations — no email wall
AZ-900 Question 1 of 7

A public web app runs on several identical VMs in one region. You must route incoming requests by URL path — /images to one pool and /api to another — and block common web attacks. Which service fits?

Answer: A — Application Gateway — layer 7 with URL path-based routing and a built-in web application firewall

Routing by the URL path means reading the HTTP request, which is a layer-7 decision, and the WAF requirement points squarely at Application Gateway — a regional layer-7 service. Why not the others: Azure Load Balancer works at layer 4 (IP and port only), so it cannot see the path. Traffic Manager only returns a DNS answer and never inspects HTTP. Front Door does layer-7 routing and WAF too, but it is a global edge service — overkill when everything lives in one region. Pro tip: 'route by URL path' inside one region equals Application Gateway.

AZ-900 Question 2 of 7

You must distribute inbound traffic for a non-HTTP protocol on a custom TCP port across a set of VMs in a single region, at very high throughput and low latency. Which service is designed for this?

Answer: A — Azure Load Balancer — layer 4, distributes TCP and UDP traffic across VMs

A custom, non-HTTP TCP workload needs a layer-4 distributor that works on IP and port without caring about application content — that is exactly Azure Load Balancer. Why not the others: Application Gateway and Front Door are layer-7 services that understand HTTP/HTTPS, so they are the wrong tool for an arbitrary TCP protocol. Traffic Manager only hands out DNS responses; it does not carry the traffic. Pro tip: non-HTTP or raw TCP/UDP across VMs equals Azure Load Balancer.

AZ-900 Question 3 of 7

Which service makes its routing decision using only the IP address and port, without ever looking at the content of the request?

Answer: A — Azure Load Balancer (layer 4)

Deciding purely on IP and port is the definition of layer-4 load balancing, and Azure Load Balancer is the layer-4 service in the family. Why not the others: Application Gateway and Front Door operate at layer 7, so they can read the HTTP request — hostname, path, headers — to route. Traffic Manager works at the DNS layer, resolving a name to an endpoint rather than balancing packets. Pro tip: layer 4 = IP + port; layer 7 = reads the HTTP request.

AZ-900 Question 4 of 7

Your app is deployed in three Azure regions. You want a single global entry point that terminates HTTPS at the edge, caches static content close to users, blocks attacks with a WAF, and sends each user to the nearest healthy region. Which service?

Answer: A — Azure Front Door — global layer-7 entry with CDN caching and WAF at the edge

A global HTTP entry point that also caches content and runs a WAF at the edge is Azure Front Door — it combines global routing with CDN and web-application-firewall features. Why not the others: Traffic Manager routes globally but only at the DNS level, with no edge caching, WAF, or HTTPS termination. Application Gateway is regional, so it cannot be the single global door for three regions. Azure Load Balancer is layer 4 and regional — no HTTP awareness at all. Pro tip: global edge + caching + WAF equals Front Door.

AZ-900 Question 5 of 7

You need global routing that sends users to the closest region, but your workload is a non-HTTP service (for example a mail server) that Front Door cannot front. Which service works at the DNS level and can point to any endpoint?

Answer: A — Traffic Manager — DNS-based global routing to any endpoint by geography or performance

Traffic Manager routes at the DNS layer, so it can direct users to any endpoint — Azure, on-premises, or external — regardless of protocol, which is what a non-HTTP workload needs. Why not the others: Front Door is a layer-7 HTTP/HTTPS service and cannot front an arbitrary protocol like SMTP. Application Gateway and Azure Load Balancer are both regional, so neither provides global closest-region routing. Pro tip: global + non-HTTP + 'any endpoint' equals Traffic Manager.

AZ-900 Question 6 of 7

You have identical app deployments across several regions. Inside each region, several identical VMs serve HTTP traffic. You want users sent to the nearest region AND traffic spread evenly across the VMs within that region. Which combination is correct?

Answer: A — A global service (Front Door or Traffic Manager) for closest-region routing, plus a regional load balancer inside each region

The two needs sit at different scopes: choosing the region is a global job (Front Door or Traffic Manager), and spreading traffic across VMs inside a region is a regional job (Load Balancer or Application Gateway), so you combine one of each. Why not the others: Azure Load Balancer is regional only and cannot route between regions. Application Gateway is also regional, not a single global deployment. Traffic Manager only returns a DNS answer — it never balances traffic across the individual VMs. Pro tip: global service picks the region, regional service spreads inside it — the exam loves a 'both' answer.

AZ-900 Question 7 of 7

Which two services can inspect the HTTP request itself — such as the hostname or URL path — to decide where a request goes?

Answer: A — Application Gateway and Azure Front Door (both layer 7)

Reading the HTTP request to route by hostname or path is a layer-7 capability, and the two layer-7 services here are Application Gateway (regional) and Azure Front Door (global). Why not the others: Azure Load Balancer is layer 4 and sees only IP and port. Traffic Manager works at the DNS level and resolves a name before any HTTP request is even sent, so it cannot read the path. Pro tip: only the two layer-7 services — App Gateway and Front Door — understand URLs; scope (regional vs global) tells them apart.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 7 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 300 more questions built exactly like them.

Collecting questions yourself

  • Scattered across forums, of unknown age
  • Answer keys without reasoning
  • No idea which domain you are weak in

Practising with a system

  • 300 questions in 6 full tests, AZ-900 (2026)
  • Every option explained — including the wrong ones
  • Readiness per exam domain, and drills for your weakest
Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

Load Balancer or Application Gateway — how do I choose?
Match the layer to the need. Azure Load Balancer is a layer-4 service: it spreads TCP or UDP traffic across VMs using only IP and port, with no awareness of URLs — ideal for non-HTTP workloads and raw throughput. Application Gateway is layer 7: it reads the HTTP request, so it can route by URL path or hostname and add a web application firewall. If the scenario mentions paths, hostnames, or a WAF, it is Application Gateway; if it is raw TCP/UDP across VMs, it is Load Balancer.
When do I use Front Door versus Traffic Manager?
Both route globally, but at different layers. Azure Front Door is a layer-7 edge service: it terminates HTTPS, caches static content like a CDN, runs a WAF, and sends users to the nearest healthy region — great for global web apps. Traffic Manager works purely at the DNS level, returning the best endpoint by geography, priority, or performance, and it can point to any endpoint including non-HTTP or external ones. Choose Front Door for HTTP apps that want edge caching and WAF; choose Traffic Manager when you need DNS-level global routing to any protocol.
Are these real AZ-900 exam questions?
No. They are our own questions, written in the style and difficulty of the exam. Reproducing real exam items violates the Microsoft certification agreement and can cost you your certification, and a copied item teaches you nothing about the next one. Our full bank holds 300 questions across 6 practice tests, and the certificate you earn does not expire.

Updated for AZ-900 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.