AZ-500 Question 103
Select 2You need to deploy a public-facing solution in Azure using an Application Gateway to load balance two Azure Web Apps. The solution must provide end-to-end SSL encryption and probe each Web App’s /health endpoint to verify service health. Which two tasks must you perform to meet these requirements?
- A
Upload a PFX certificate for the front-end listener to enable HTTPS termination, then configure the back-end HTTP setting to use HTTPS and upload the web apps’ certificates as trusted root certificates in the Application Gateway.
- B
Use the built-in default health probe to automatically detect the /health endpoints over HTTP, ensuring minimal configuration overhead.
- C
Configure a custom probe using the HTTPS protocol, specifying /health as the probe path, and confirm the Web Apps return a 200 status code for successful checks.
- D
Enable 'Response Based Detection' in the Application Gateway WAF policy to automatically discover all endpoints, eliminating the need for manual probe configuration.
Show answer and explanation
Correct answers: A, C
Explanation
To implement an Azure Application Gateway with end-to-end SSL, you must configure HTTPS on both the front and back ends. The gateway also needs the back-end certificates added as trusted roots so it can validate traffic to the Web Apps. For health monitoring, Azure Application Gateway supports custom probes to specify a custom path (e.g., /health) and the protocol (HTTPS). Microsoft’s documentation (https://docs.microsoft.com/azure/application-gateway/application-gateway-create-probe-portal and https://docs.microsoft.com/azure/application-gateway/ssl-overview) outlines these configurations and how to set up an end-to-end SSL scenario using custom probes.
- A. Correct.
Option 1 is correct. To achieve end-to-end SSL, you must enable HTTPS at the front-end and also encrypt traffic to the Web Apps at the back end. You do this by uploading a proper PFX certificate for the front end and configuring an HTTPS back-end pool with the back-end certificates trusted by the Application Gateway.
- B. Incorrect.
Option 2 is incorrect. The default health probe only checks the root path (/) using HTTP by default. Since you need a specific path (/health) and want to use HTTPS, relying on the default probe won’t meet your exact requirements.
- C. Correct.
Option 3 is correct. A custom probe is required to specify the exact path (/health) and the HTTPS protocol. Configuring this ensures the gateway accurately checks the availability of the Web Apps based on returning a 200 status code at the /health endpoint.
- D. Incorrect.
Option 4 is incorrect. There is no 'Response Based Detection' feature that automatically discovers all endpoints. Azure Application Gateway does not remove the need for custom probes simply by enabling a WAF policy. When specific paths or protocols are needed, a custom probe is required.