AZ-500 Question 87
Single answerYou have a critical internal web application hosted on Azure App Service that needs to connect to an on-premises database. Your company has a site-to-site VPN between an Azure Virtual Network and the on-premises network, and the web application must be accessible only to your internal users. Which approach should you implement to meet these requirements?
- A
Create a private endpoint for the App Service, link it to the Azure Virtual Network, and disable public access to the app.
- B
Assign a public IP address to the App Service and secure it with a network security group (NSG) that restricts external traffic.
- C
Use service endpoints on the App Service to directly reach the on-premises network over the site-to-site VPN.
- D
Enable Hybrid Connections on the App Service and open inbound ports on the Azure gateway to allow connectivity.
Show answer and explanation
Correct answer: A
Explanation
By creating a private endpoint for the App Service, you ensure inbound traffic remains within a private IP range, removing the public endpoint altogether. You can then use VNet integration to route outbound traffic through the Azure Virtual Network to the on-premises database over the site-to-site VPN. This aligns with Azure best practices for secure network integration. Refer to Azure App Service documentation at https://learn.microsoft.com/azure/app-service/overview-vnet-integration for detailed steps and recommendations.
- A. Correct.
Option 1 is correct. With a private endpoint, inbound traffic to the Azure App Service stays within the private IP space. Combined with App Service VNet integration for outbound connectivity, you can ensure the application only communicates internally and block public access at the app level. This meets the requirement of isolating traffic and allowing only on-premises and internal Azure traffic.
- B. Incorrect.
Option 2 is incorrect. Assigning a public IP and using an NSG might block or restrict traffic, but it still exposes a public endpoint. NSGs do not apply directly to the multi-tenant Azure App Service the same way they do to Azure virtual machines, and this approach does not fully eliminate public exposure for the web app.
- C. Incorrect.
Option 3 is incorrect. Service endpoints provide direct connectivity to Azure services such as Azure Storage or Azure SQL Database within Azure, but they are not designed to connect to on-premises resources. They also do not restrict inbound traffic for the App Service from the public internet.
- D. Incorrect.
Option 4 is incorrect. Hybrid Connections are more suited to scenarios involving specific TCP endpoints, often behind firewalls. They do not provide a fully private route for inbound traffic to the web app itself, nor do they inherently disable the public endpoint of the App Service.