Cascade Regional Airlines wants to give global customers a single hostname for its booking site that accelerates HTTPS traffic at the network edge, applies a WAF close to the user, and can fail over between regional backends, rather than simply resolving a DNS name to whichever region is currently healthy. Which service best fits this need?

Azure Front Door is a global, Layer 7 application delivery service that operates at Microsoft's edge points of presence, meaning it actually terminates client HTTPS connections close to the user, can apply a WAF and caching at that edge point, and then proxies the request onward to the healthiest backend region — providing real data-plane acceleration and failover, not just a DNS answer. Traffic Manager is purely a DNS-based routing method: it resolves a domain name to the IP address of the appropriate regional endpoint based on the chosen routing method, but once resolved, the client connects directly to that region with no edge acceleration, WAF, or Front Door-style proxying involved. Azure DNS is simply a managed DNS hosting service for zones and records; it has no routing intelligence or health-based failover logic of its own. A regional Standard Load Balancer operates within a single region and has no global, cross-region failover capability at all. The exam-relevant caveat: because Front Door terminates TLS and proxies traffic, it requires backend health probes and origin configuration much like a reverse proxy, and it is billed and architected differently from a purely DNS-based solution. Operationally, confirm the design choice by checking that client connections in a network trace terminate at a Front Door edge IP rather than resolving straight to a regional backend's public IP.