Hotspot Question You have an Azure subscription. You plan to deploy an internet-facing app named App1 across three Azure regions. You need to recommend a secure public access solution that meets the…

The correct answer is Globally distribute requests:: Azure Front Door; Manage SSL offloading:: Azure Web Application Firewall (WAF) v2 on Azure Application Gateway. Azure Public Access Solution - Exam Explanation --- Dropdown 1: Globally Distribute Requests Correct Answer: Azure Front Door Why Front Door is correct: Azure Front Door is a global, Layer 7 load balancer and CDN that operates at the network edge (Microsoft's global WAN). It…

Submitted by femi9· Mar 6, 2026Secure networking

Question

Hotspot Question You have an Azure subscription. You plan to deploy an internet-facing app named App1 across three Azure regions. You need to recommend a secure public access solution that meets the following requirements: - Globally distributes requests across all three regions while supporting HTTP, HTTPS, and FTP - Manages SSL offloading in each region Which service should you recommend for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibits

Answer Area

Globally distribute requests:Azure Front Door
Azure Front DoorAzure Load BalancerAzure Traffic ManagerAzure Virtual Network ManagerAzure Web Application Firewall (WAF) v2 on Azure Application Gateway
Manage SSL offloading:Azure Web Application Firewall (WAF) v2 on Azure Application Gateway
Azure Load BalancerAzure Traffic ManagerAzure Virtual Network ManagerAzure Web Application Firewall (WAF) v2 on Azure Application Gateway

Explanation

Azure Public Access Solution - Exam Explanation

Dropdown 1: Globally Distribute Requests

Correct Answer: Azure Front Door

Why Front Door is correct: Azure Front Door is a global, Layer 7 load balancer and CDN that operates at the network edge (Microsoft's global WAN). It natively supports HTTP, HTTPS, and FTP routing across multiple regions using Anycast routing, making it purpose-built for globally distributing internet-facing traffic. It also provides health probes to failover between regions automatically.

Why the others are wrong:

Option	Why Wrong
Azure Load Balancer	Layer 4 only (TCP/UDP), regional scope - not global, no HTTP/FTP awareness
Azure Traffic Manager	DNS-based global routing (Layer 7 DNS), but it only redirects DNS - it doesn't distribute actual request traffic and has no protocol-level handling
Azure Virtual Network Manager	Manages VNet topology and connectivity policies - not a traffic distribution service
WAF v2 on Application Gateway	Regional service only; cannot span three regions globally on its own

Dropdown 2: Manage SSL Offloading

Correct Answer: Azure Web Application Firewall (WAF) v2 on Azure Application Gateway

Why WAF v2 on Application Gateway is correct: Application Gateway is a regional Layer 7 load balancer that natively performs SSL/TLS termination (offloading) - it decrypts HTTPS traffic at the gateway, forwards plain HTTP to backend servers, reducing compute load on app servers. WAF v2 adds security inspection on top. Since the requirement is to manage SSL offloading in each region, you deploy Application Gateway (with WAF) per region behind Front Door.

Why the others are wrong:

Option	Why Wrong
Azure Load Balancer	Layer 4 only - has no concept of SSL certificates or TLS termination
Azure Traffic Manager	DNS-only service, completely unaware of SSL/TLS - it never touches actual traffic payloads
Azure Virtual Network Manager	Network topology management only - no traffic inspection or SSL capabilities

The Core Architecture Pattern

The two services work together as a layered solution:

Internet → Azure Front Door (global routing + HTTP/HTTPS/FTP distribution)
               ↓  ↓  ↓
         Region A  Region B  Region C
         [WAF v2 on App Gateway] ← SSL offloading happens here, per region
               ↓
            App1 backends

Key concept: Front Door handles where traffic goes (globally); Application Gateway with WAF handles how traffic is processed (SSL offloading + security inspection) locally in each region.

Topics

#Azure Front Door#Application Gateway#SSL Offloading#Global Load Balancing

Community Discussion

No community discussion yet for this question.

Full AZ-500 Practice