AZ-500 Question 105
Select 2You are designing a secure deployment of an internal web application hosted on Azure Virtual Machines behind an Azure Application Gateway with the Web Application Firewall (WAF) enabled. The requirement is to maintain end-to-end SSL encryption from the client to the VMs, using a custom domain certificate that is already installed on the VMs. Which two actions must you take in Azure Application Gateway to ensure end-to-end SSL encryption?
- A
Add the VM’s root or intermediate certificate to the Application Gateway’s trusted root certificates and configure the backend HTTP setting to use HTTPS
- B
Enable the ‘Rewrite HTTP headers’ option in WAF settings to pass the SSL details through to the backend pool
- C
Bind your custom SSL certificate to the Application Gateway’s front-end listener, enabling HTTPS on the listener
- D
Set WAF to 'Prevention' mode to ensure all traffic is fully encrypted
Show answer and explanation
Correct answers: A, C
Explanation
To achieve end-to-end SSL (or TLS) with an Azure Application Gateway configured with WAF, you must encrypt traffic from the client to the gateway and then re-encrypt from the gateway to the backend servers. This requires uploading the root or intermediate certificate to the Application Gateway so it can trust the backend server certificates (Option 1). You must also bind the Application Gateway listener to a valid SSL certificate for your front-end domain (Option 3). Additional details are available in Microsoft’s documentation on ‘End to end SSL with Application Gateway’: https://learn.microsoft.com/azure/application-gateway/end-to-end-ssl.
- A. Correct.
Correct. To establish end-to-end SSL, Application Gateway must trust the backend’s certificate. You need to upload the backend’s root or intermediate CA certificates under ‘Trusted root certificates’ and select HTTPS in the backend pool’s HTTP settings so that the gateway re-encrypts traffic to the VMs.
- B. Incorrect.
Incorrect. ‘Rewrite HTTP headers’ allows customizing or removing certain headers, but it does not provide SSL re-encryption or certificate trust. Relying on HTTP headers alone does not achieve end-to-end encryption.
- C. Correct.
Correct. The front-end listener must be configured with a valid SSL certificate for your custom domain so user requests over HTTPS terminate at the Application Gateway. This is the first step in ensuring traffic is encrypted as it comes in from the client.
- D. Incorrect.
Incorrect. Setting WAF to ‘Prevention’ mode enforces blocking of malicious traffic, but it does not automatically enable end-to-end SSL. Encrypted traffic requires proper certificate configuration on both the front end and the back end.