nerdexam
Microsoft

AZ-500 · Question #606

You have an Azure subscription that contains a virtual network named VNet1. The subscription contains an Azure App Service web app named App1. You have an Azure Front Door profile named AFD1 that…

The correct answer is B. For App1, configure the HTTP headers filter settings. To ensure that all inbound traffic to App1 is filtered through Azure Front Door (AFD1), you should configure App1 to only accept traffic that comes through Azure Front Door by setting up HTTP headers filtering. Specifically, you can configure the web app to check for the…

Submitted by tyler.j· Mar 6, 2026Secure networking

Question

You have an Azure subscription that contains a virtual network named VNet1. The subscription contains an Azure App Service web app named App1. You have an Azure Front Door profile named AFD1 that has an Azure Web Application Firewall (WAF) policy. You need to ensure that all inbound traffic to App1 is filtered through AFD1. What should you do?

Options

  • AFor VNet1, configure network security group (NSG) rules.
  • BFor App1, configure the HTTP headers filter settings.
  • CFor App1, enable virtual network integration.
  • DConfigure Microsoft Entra application proxy.

How the community answered

(15 responses)
  • A
    13% (2)
  • B
    80% (12)
  • C
    7% (1)

Explanation

To ensure that all inbound traffic to App1 is filtered through Azure Front Door (AFD1), you should configure App1 to only accept traffic that comes through Azure Front Door by setting up HTTP headers filtering. Specifically, you can configure the web app to check for the presence of certain headers added by Azure Front Door, such as the X-Azure-FDID header, to ensure that only traffic from Azure Front Door is allowed.

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice