Hotspot Question You have an Azure App Service web app named App1 as shown in the following exhibit. Subnet 2 contains a virtual machine named VM1. Use the drop-down menus to select the answer…

Question

Exhibit

Answer Area

• To deny outbound access, configure [answer choice] on Subnet2.
  a network security group (NSG)a service endpointan application security group
• To connect to a virtual network in a different region, configure [answer choice].
  an Azure NAT Gateway integrationGateway-required VNet integrationsRegional VNet integrations

Explanation

This hotspot question tests knowledge of Azure App Service VNet Integration and how inbound/outbound traffic flows work when a web app is integrated with a virtual network subnet.

Approach. When an Azure App Service web app uses VNet Integration (outbound), the app can reach resources in the integrated subnet (Subnet 2) and beyond, but inbound traffic to the app still comes through the public App Service endpoint - not through the VNet. Therefore, App1 CAN access VM1 in Subnet 2 (outbound VNet Integration enables this), but VM1 CANNOT initiate connections to App1 directly through the VNet (inbound access requires Private Endpoints, not VNet Integration). The correct answers are: App1 can connect to VM1 (Yes/True), and VM1 can initiate connections to App1 via the VNet (No/False) - because VNet Integration is outbound only and does not place the app inside the VNet for inbound purposes.

Concept tested. Azure App Service VNet Integration - understanding the difference between outbound VNet Integration (allows app to reach VNet resources) and inbound Private Endpoint (allows VNet resources to reach the app). VNet Integration is strictly outbound; it does not allow resources inside the VNet to initiate inbound connections to the app through the VNet.

Reference. https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration

No community discussion yet for this question.