AZ-500 Question 86
Single answerYour company needs to deploy an Azure Functions app that securely reads data from an on-premises SQL database. The app must not be publicly accessible from the internet, and a site-to-site VPN is already in place between the on-premises environment and an Azure Virtual Network. Additionally, the function app should be able to scale seamlessly to handle occasional spikes in demand. Which configuration should you implement to meet these requirements?
- A
Deploy the Function App in the Premium plan, enable Regional VNet Integration with the existing Azure Virtual Network, and configure Access Restrictions to allow traffic only from the VNet.
- B
Deploy the Function App in the Consumption plan with service endpoints for on-premises connectivity, and rely on Azure Firewall to restrict Internet traffic.
- C
Use a dedicated App Service Environment (ASE) with public IP restrictions disabled, then manually configure scaling by increasing instance count as needed.
- D
Deploy the Function App in a Linux container without VNet integration and rely on built-in platform scaling to access on-premises resources over the public endpoint.
Show answer and explanation
Correct answer: A
Explanation
To securely connect Azure Functions to on-premises resources without exposing the app to the public internet, you should take advantage of Premium plan’s Regional Virtual Network Integration and use Access Restrictions to lock down inbound traffic. This allows outbound connections to on-premises networks through site-to-site VPN and ensures autoscaling is available for periodic spikes in demand. For more details, refer to the official Microsoft documentation on App Service VNet Integration: https://learn.microsoft.com/azure/app-service/overview-vnet-integration.
- A. Correct.
Option 1 is correct. Placing the Function App in the Premium plan supports Regional VNet Integration, which allows outbound traffic to flow through the site-to-site VPN to on-premises resources. By also configuring Access Restrictions, you can eliminate direct public access to the Function App. This approach aligns with the requirement for scalable computing while ensuring secure private connectivity.
- B. Incorrect.
Option 2 is incorrect because Consumption plan does not support the kind of private VNet Integration required to access on-premises networks. Although service endpoints help secure traffic within Azure, they do not extend to on-premises resources. Azure Firewall alone does not fully restrict inbound traffic to the Function App.
- C. Incorrect.
Option 3 is incorrect because while an App Service Environment (ASE) provides a fully isolated environment, it is typically used for more specialized or regulatory scenarios and can be more complex and costly. Additionally, the question specifies seamless scaling for occasional spikes, which is more straightforward with the Premium plan. Manual scaling in an ASE is not as straightforward for handling unpredictable spikes.
- D. Incorrect.
Option 4 is incorrect because placing the Function App in a Linux container without VNet integration would still expose it publicly unless additional networking configurations are applied. Furthermore, it does not address the requirement to securely connect to on-premises resources only via the site-to-site VPN.