AZ-104 Question 182
Single answerYou have an Azure App Service named WebAppProd that uses a custom domain (www.contoso.com). You want to ensure all traffic is secured using your organization's TLS 1.2 certificate. After purchasing and downloading the certificate (in PFX format), which of the following approaches correctly configures the App Service to use this certificate and enforce TLS 1.2?
- A
Upload the .PFX certificate under TLS/SSL settings, bind it to the custom domain using SNI SSL, and set the Minimum TLS Version to 1.2 in Configuration > General settings.
- B
Create a self-signed certificate in the Azure Portal and associate it to the App Service without adjusting the App Service's TLS version.
- C
Set a custom domain in the Azure Portal, then configure TLS 1.2 enforcement in the Azure DNS zone properties.
- D
Generate an SSH key for the custom domain and configure the App Service's TLS to 1.1 or lower to allow backward compatibility.
Show answer and explanation
Correct answer: A
Explanation
To secure an App Service with a custom certificate and enforce TLS 1.2, you need to upload the purchased (PFX) certificate to the TLS/SSL settings, bind it to the custom domain as an SNI SSL binding, and configure the minimum TLS version under the App Service's Configuration.
- A. Correct.
Correct: You must upload the certificate in PFX format, bind the certificate to the custom domain with SSL (usually SNI-based), and then set the Minimum TLS Version to 1.2 in the Configuration > General settings.
- B. Incorrect.
Incorrect: Simply creating a self-signed certificate does not ensure the production app is properly secured, and failing to update the minimum TLS version leaves the app vulnerable to weaker protocols.
- C. Incorrect.
Incorrect: TLS version enforcement for App Services is configured in the App Service settings, not in the DNS zone properties.
- D. Incorrect.
Incorrect: SSH keys are not used to secure custom domains for App Services, and setting TLS to 1.1 or lower is not recommended for secure traffic.