AZ-104 Question 183
Single answerYou have deployed a web application to Azure App Service that must meet strict compliance requirements. You uploaded your organization's private key certificate under TLS/SSL settings for a custom domain. The security policy states that only TLS 1.2 is permitted. Which step is required to ensure all traffic to the app is secured using at least TLS 1.2?
- A
Enable 'HTTPS Only' in the App Service's Configuration settings
- B
Set the 'Minimum TLS Version' to 1.2 in the TLS/SSL settings
- C
Add a custom domain CNAME record in DNS pointing to the default .azurewebsites.net domain
- D
Upload the root certificate to the App Service to enable TLS 1.2
Show answer and explanation
Correct answer: B
Explanation
To restrict all connections to TLS 1.2 or higher on an App Service, you must configure the App Service’s TLS/SSL settings so that its 'Minimum TLS Version' is set to 1.2. This ensures that any clients attempting to connect using older protocols, such as TLS 1.0 or TLS 1.1, are blocked.
- A. Incorrect.
Enabling 'HTTPS Only' ensures traffic is forced over HTTPS, but does not enforce a specific TLS version by itself.
- B. Correct.
Setting the 'Minimum TLS Version' to 1.2 explicitly prevents older protocol versions from being used for the connection.
- C. Incorrect.
Pointing a custom domain to an Azure App Service is necessary for vanity URLs, but this does not enforce TLS version requirements.
- D. Incorrect.
Uploading the root certificate can be useful in certain scenarios, but enforcing TLS 1.2 specifically is done by configuring the minimum TLS version.