Hotspot Question You plan to deploy an Azure App Service web app named App1 that will service users in a single geographical region. App1 will access a highly available database named DB1 that will be

This hotspot question tests knowledge of Azure networking services and their appropriate use cases for securing web apps, VMs, and internal database traffic while minimizing costs.

Submitted by mateo_ar· Mar 6, 2026Design infrastructure solutions

Question

Hotspot Question You plan to deploy an Azure App Service web app named App1 that will service users in a single geographical region. App1 will access a highly available database named DB1 that will be hosted on two Azure virtual machines named VM1 and VM2. You need to recommend a solution that meets the following requirements: - Uses Azure Web Application Firewall (WAF) to minimize the risk of a web-based attack against App1 - Ensures that administrators can access VM1 and VM2 securely from the internet - Ensures that traffic from App1 to DB1 is NOT sent via the internet - Minimizes costs What should you include in the recommendation for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibits

Answer Area

Minimize the risk of a web-based attack against App1:
Azure Application GatewayAzure Front DoorAzure Load BalancerAzure Traffic Manager
Provide administrative access to VM1 and VM2:
Azure Application GatewayAzure BastionAzure Front DoorAzure Lighthouse
Provide App1 with access to DB1:
A private endpointAzure Application GatewayAzure Private LinkVirtual network integration

Explanation

This hotspot question tests knowledge of Azure networking services and their appropriate use cases for securing web apps, VMs, and internal database traffic while minimizing costs.

Approach. For WAF protection of App1: Use Azure Application Gateway with WAF (not Azure Front Door, which is more expensive and designed for global distribution - since App1 serves a single region, Application Gateway with WAF is the cost-minimizing choice). For secure administrator access to VM1 and VM2 from the internet: Use Azure Bastion, which provides secure RDP/SSH access over TLS without exposing VMs to public IPs or requiring a VPN. For ensuring traffic from App1 to DB1 is NOT sent via the internet: Use VNet Integration (Azure App Service VNet Integration) combined with the VMs being on the same VNet, or use a Private Endpoint/internal VNet, ensuring all traffic stays within the Azure backbone network and never traverses the public internet.

Concept tested. The question tests understanding of: (1) Azure Application Gateway WAF vs Azure Front Door WAF - Application Gateway is regional and lower cost, appropriate for single-region deployments; (2) Azure Bastion as the secure, cost-effective alternative to jump servers or public IPs for VM administration; (3) Azure App Service VNet Integration to route traffic internally to Azure VMs without going through the public internet, satisfying the private database connectivity requirement.

Reference. https://learn.microsoft.com/en-us/azure/application-gateway/overview | https://learn.microsoft.com/en-us/azure/bastion/bastion-overview | https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration

Topics

#Web Application Firewall (WAF)#Azure Bastion#Private Link#Virtual network integration

Community Discussion

No community discussion yet for this question.

Full AZ-305 Practice