AZ-500 Question 104
Select 2Your company is migrating a multi-tier web application to Azure. You deploy an Azure Application Gateway with the Web Application Firewall (WAF) enabled. The application has two distinct paths (/api and /web) that need to be routed to separate backend pools. You also need to ensure that traffic is decrypted for inspection at the gateway and then re-encrypted when forwarding to the backend servers. Which two configurations must you implement to meet these requirements?
- A
Deploy the Application Gateway in its own dedicated subnet and set WAF to Prevention mode.
- B
Add a path-based rule in the Application Gateway to direct /api and /web traffic to different backend pools.
- C
Enable SSL offloading so that all inbound HTTPS traffic is terminated at the gateway and forwarded via HTTP.
- D
Specify a trusted certificate in the HTTP settings to re-encrypt traffic to each backend pool.
- E
Configure a multi-site listener using separate front-end IP addresses for each path.
Show answer and explanation
Correct answers: B, D
Explanation
To meet the scenario requirements of path-based routing and end-to-end encryption (including inspection and then re-encryption), you need to configure path-based rules for /api and /web, and specify certificates for re-encrypting traffic to the backend pools. Refer to official Microsoft documentation on Azure Application Gateway for details on path-based routing and end-to-end SSL/TLS configuration.
- A. Incorrect.
Although a dedicated subnet and WAF Prevention mode can be important for secure planning, they do not themselves enable path-based routing or re-encryption to backend pools. ‘Dedicated subnet’ is a requirement to deploy Application Gateway properly, but the question specifically focuses on ensuring path-based routing and end-to-end encryption.
- B. Correct.
This is correct. Path-based routing requires you to configure rules telling the gateway to forward /api and /web requests to the correct backend pools. This matches the requirement to route distinct paths to different backend targets.
- C. Incorrect.
This is incorrect. Enabling SSL offloading ends SSL at the gateway, forwarding traffic unencrypted (HTTP) to the backend. The requirement is to inspect and then re-encrypt traffic, so full end-to-end encryption is needed.
- D. Correct.
This is correct. To re-encrypt traffic after WAF inspection, you must configure a valid certificate in the HTTP settings. This allows the Application Gateway to re-establish an HTTPS connection to each backend pool.
- E. Incorrect.
This is incorrect. Multi-site listeners help if you have different domain names, but the question states that you have two paths (/api and /web) on a single domain. You can use a single listener with path-based routing rather than multiple listeners or multiple IP addresses.