nerdexam
Microsoft

AZ-204 · Question #625

Drag and Drop Question You have an Azure App Service Web App named App1. App1 has /public and /private areas. The App Service plan of App1 uses the D1 pricing tier. You plan to configure mutual TLS…

The correct answer is Upgrade the pricing tier of the App Service plan.; Modify the client certificate mode of the Configuration settings of App1.; Modify the certificate exclusion path of the Configuration settings of App1. Mutual TLS (client certificate authentication) in Azure App Service requires at least the B1 (Basic) pricing tier, so the D1 (Shared) tier must first be upgraded. After upgrading, you enable client certificates by modifying the 'Client certificate mode' in the Configuration…

Submitted by the_admin· Mar 30, 2026Implement authentication and authorization in Azure App Service / Secure Azure solutions

Question

Drag and Drop Question You have an Azure App Service Web App named App1. App1 has /public and /private areas. The App Service plan of App1 uses the D1 pricing tier. You plan to configure mutual TLS authentication for App1. The solution must minimize cost. You need to ensure that only the /private area of App1 will require mutual TLS authentication. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Answer:

Exhibit

AZ-204 question #625 exhibit

Answer Area

Drag items

Modify the client certificate mode of the Configuration settings of App1.Upgrade the pricing tier of the App Service plan.Add an identity provider to the Authentication settings of App1.Downgrade the pricing tier of the App Service plan.Modify the certificate exclusion path of the Configuration settings of App1.

Correct arrangement

  • Upgrade the pricing tier of the App Service plan.
  • Modify the client certificate mode of the Configuration settings of App1.
  • Modify the certificate exclusion path of the Configuration settings of App1.

Explanation

Mutual TLS (client certificate authentication) in Azure App Service requires at least the B1 (Basic) pricing tier, so the D1 (Shared) tier must first be upgraded. After upgrading, you enable client certificates by modifying the 'Client certificate mode' in the Configuration settings (setting it to 'Allow' or 'Require'). Finally, since only the /private area should require mutual TLS, you use the certificate exclusion path setting to exclude /public from client certificate requirements, minimizing the enforcement scope while minimizing cost by not over-engineering the solution.

Topics

#Azure App Service#Mutual TLS#Client Certificates#App Service Pricing Tiers

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-204 Practice