AZ-305 Question 33
Single answerYour organization hosts an internal line-of-business (LOB) web application on-premises that is integrated with your Windows Active Directory (AD) environment. Security policy requires that no inbound ports be opened on the corporate firewall, and you want to enable remote and external users to access this web application using their Azure AD identities. Which solution should you implement to satisfy these requirements?
- A
Use Azure Application Gateway to route external users directly to the on-premises web application
- B
Use Azure AD Application Proxy to securely publish the on-premises web application through Azure AD
- C
Deploy Azure AD Domain Services and join the on-premises servers to the managed domain
- D
Implement a VPN connection from Azure to your on-premises environment for user access
Show answer and explanation
Correct answer: B
Explanation
The Azure AD Application Proxy is the recommended solution for providing secure, external access to on-premises applications while leveraging Azure AD for authentication. It uses an outbound connection from the on-premises connector to Azure, so you do not need to open inbound ports on the corporate firewall. For more information, refer to the official Microsoft documentation on using Azure AD Application Proxy: https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy.
- A. Incorrect.
Option 1 is incorrect. Azure Application Gateway provides Layer 7 load balancing and can include a Web Application Firewall (WAF), but it does not solve the requirement of securely publishing an internal application without opening inbound ports on-premises. It typically requires additional firewall configurations or endpoints that do not address the no-inbound-ports requirement.
- B. Correct.
Option 2 is correct. Azure AD Application Proxy allows you to securely expose an on-premises application to external users without opening inbound ports on your firewall. It uses a connector installed on-premises, and authentication is handled via Azure AD, meeting both the security and seamless access requirements.
- C. Incorrect.
Option 3 is incorrect. Azure AD Domain Services (AAD DS) provides domain services such as LDAP, Kerberos, and NTLM for cloud-based resources. It might help if you need a managed domain in Azure, but it does not offer a direct solution to securely publish on-premises web applications for external access without changing your firewall configuration.
- D. Incorrect.
Option 4 is incorrect. While a VPN enables connectivity to the on-premises network, it does not satisfy the requirement to avoid inbound ports and does not directly integrate with Azure AD authentication for seamless external access. You would also have to manage and maintain the VPN solution for all external users, which adds complexity.