AZ-104 Question 192
Select 2You are an Azure Administrator for a company that hosts a web application using Azure App Service. The application must only accept HTTPS requests from a specific subnet in your Azure Virtual Network. Which action(s) should you take to meet this requirement?
- A
Enable Virtual Network Integration for your App Service and create an Access Restriction rule allowing traffic from that subnet
- B
Configure a Private Endpoint for the App Service and secure it with an NSG that allows traffic only from the subnet
- C
Enable 'Always Encrypted' in App Service settings to block all non-HTTPS traffic
- D
Deploy a separate App Service Environment that runs entirely within your Azure Virtual Network
Show answer and explanation
Correct answers: A, B
Explanation
To restrict Azure App Service traffic to a specific subnet, you can use either VNet Integration with Access Restrictions or a Private Endpoint secured by an NSG. These methods directly control inbound requests and ensure traffic is only allowed from the specified subnet over HTTPS.
- A. Correct.
This approach integrates the App Service with the VNet and then restricts traffic to the intended subnet, ensuring only permitted IP ranges can reach the app over HTTPS.
- B. Correct.
A Private Endpoint allots a private IP in your VNet and you can use an NSG to restrict access to a specific subnet, fulfilling the requirement to limit inbound traffic.
- C. Incorrect.
'Always Encrypted' is a feature used typically in SQL databases to protect data. It does not restrict inbound traffic to a specific subnet in App Service.
- D. Incorrect.
While deploying a separate App Service Environment isolates your app within the VNet, it does not inherently limit traffic to the specific subnet without additional configuration. Thus, it is unnecessary for this particular requirement alone.