SC-100 · Question #44
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might…
The correct answer is B. No. The correct answer is B: No. Gateway-required virtual network integration does not meet the goal. VNet integration is an outbound connectivity feature - it allows an App Service web app to make outbound calls to resources inside an Azure Virtual Network. It does not control or…
Question
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance. You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance. Solution: You recommend configuring gateway-required virtual network integration. Does this meet the goal?
Exhibit
Options
- AYes
- BNo
How the community answered
(49 responses)- A24% (12)
- B76% (37)
Explanation
The correct answer is B: No. Gateway-required virtual network integration does not meet the goal. VNet integration is an outbound connectivity feature - it allows an App Service web app to make outbound calls to resources inside an Azure Virtual Network. It does not control or restrict inbound traffic to the web app. To ensure that App Service web apps only accept traffic originating from Azure Front Door, you need inbound access restrictions. The correct approach is to configure App Service access restrictions using the 'AzureFrontDoor.Backend' service tag, and/or validate the 'X-Azure-FDID' header to confirm requests came through your specific Front Door instance. This blocks direct internet requests to the App Service origin, forcing all traffic through Front Door (and its WAF).
Topics
Community Discussion
No community discussion yet for this question.