Get Your CertAZ-305PlayCompete
‹ All AZ-305 questions

AZ-305 Practice Question 30: Regional Layer 7 Routing

Microsoft Azure Solutions Architect Expert (AZ-305) · Test 3 · question 10 of 10

Infrastructure Solutionseasy

A university runs a single-region web application on virtual machines in one virtual network in North Europe. The redesign must:

- route requests whose path starts with /api to one backend pool and /portal to another, - terminate TLS at the entry point using a certificate stored in Azure Key Vault, - inspect incoming requests with a managed OWASP rule set, - keep every backend virtual machine without a public IP address, and keep all traffic inside the region.

Which service should you place in front of the virtual machines?

Select one answer
Show answer and explanation

Answer:

  • B. An Application Gateway v2 with WAF, deployed into a dedicated subnet of the same virtual network

Application Gateway is a layer 7 web traffic load balancer that routes on HTTP attributes such as URL paths, which is the first requirement stated almost word for word. Its feature set covers the rest: TLS termination at the gateway with certificates from Key Vault, an integrated Web Application Firewall in the WAF_v2 SKU, and deployment as a dedicated resource into its own subnet of the application's virtual network, so the backends stay private and the traffic never leaves the region.

Option A operates at the wrong layer. Azure Load Balancer distributes traffic on the transport layer using IP address and port. It cannot read a URL path, cannot terminate TLS, and offers no WAF.

Option C brings a global service to a single-region problem, and the option's own wording breaks a requirement: pointing Front Door at the virtual machines' public IP addresses means giving them public IP addresses. Front Door is the right answer when the goal is global routing and edge failover, which this scenario explicitly does not have.

Option D balances at DNS. Traffic Manager hands the client an address and leaves the data path, so it cannot do path-based routing, TLS termination, or WAF inspection; it is the option Microsoft points to only when you do not need TLS offload or application-layer processing.

Reference: What is Azure Application Gateway?

Practice Test 3 ›

Study guides for AZ-305

Azure certification path 2026: AZ-900, AZ-104, AZ-305The Azure certification path for 2026 - AZ-900, AZ-104 and AZ-305 in order, what each covers, the AZ-305 prerequisite, renewal and what to skip.
Azure RBAC vs Azure Policy vs Entra roles vs resource locksHow Azure RBAC, Azure Policy, Microsoft Entra roles and resource locks differ, how scope inheritance works, and when deny beats audit.
Azure Storage redundancy - LRS, ZRS, GRS, GZRS and failoverHow LRS, ZRS, GRS, RA-GRS, GZRS and RA-GZRS differ, what failover does to your account, and how access tiers interact with redundancy.