SC-100 · Question #46
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might…
The correct answer is A. Yes. The answer is Yes - using App Service access restrictions with the AzureFrontDoor.Backend service tag does meet the goal. Azure provides managed service tags that represent the IP address ranges used by specific Azure services. By configuring an access restriction rule in Azure…
Question
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance. You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance. Solution: You recommend access restrictions that allow traffic from the Front Door service tags. Does this meet the goal?
Options
- AYes
- BNo
How the community answered
(57 responses)- A72% (41)
- B28% (16)
Explanation
The answer is Yes - using App Service access restrictions with the AzureFrontDoor.Backend service tag does meet the goal. Azure provides managed service tags that represent the IP address ranges used by specific Azure services. By configuring an access restriction rule in Azure App Service that only allows inbound traffic matching the AzureFrontDoor.Backend service tag, you ensure that only requests routed through Azure Front Door can reach the web app. Microsoft maintains and updates these IP ranges automatically, making this a robust and low-maintenance approach. For additional security, you should also validate the X-Azure-FDID header to ensure requests come from your specific Front Door instance and not another customer's.
Topics
Community Discussion
No community discussion yet for this question.