AZ-500 Question 88
Select 2Your organization hosts a line-of-business application in an Azure App Service Environment (ASE) configured in internal load balancing (ILB) mode. The application should only be accessible from your corporate on-premises network. You have established an ExpressRoute connection for secure connectivity between on-premises and Azure. Which two configurations should you implement to ensure inbound traffic is restricted exclusively to your corporate network?
- A
Configure IP address restrictions at the ASE or App level to allow only the on-premises IP address ranges.
- B
Implement forced tunneling on the ASE subnet to route all inbound traffic through the on-premises firewall.
- C
Associate a Network Security Group (NSG) with the ASE subnet that only allows inbound traffic from the on-premises IP range.
- D
Deploy an Azure Application Gateway with geo-filtering enabled in the same virtual network to isolate traffic to your region.
Show answer and explanation
Correct answers: A, C
Explanation
To lock down an internal ASE so that only the organization's on-premises network can reach it, use a combination of IP address restrictions at the ASE or app level and an NSG to limit inbound traffic to specific IP ranges. Forced tunneling is not designed for inbound traffic filtering, and geo-filtering alone does not guarantee that only your corporate IP addresses are allowed. For more details, consult the official documentation on securing an App Service Environment: https://learn.microsoft.com/azure/app-service/environment/intro.
- A. Correct.
Option 1 is correct. IP-based access restrictions (sometimes called Access Restrictions) on the ASE or the hosted apps allow you to explicitly permit inbound traffic only from specific IP addresses or ranges. This is a straightforward and recommended way to limit inbound traffic to your corporate IP addresses.
- B. Incorrect.
Option 2 is incorrect. Forced tunneling is typically used to route outbound traffic from Azure to an on-premises firewall, not inbound traffic. It does not by itself ensure that only on-premises traffic can reach your ASE.
- C. Correct.
Option 3 is correct. Associating an NSG with the ASE's subnet and configuring inbound rules to only allow connections from your on-premises IP range is a best practice for network-level filtering. This approach provides an additional layer of control alongside IP-based restrictions.
- D. Incorrect.
Option 4 is incorrect. An Application Gateway with geo-filtering can block traffic from certain countries or regions, but it does not necessarily restrict access to only your specific corporate IP addresses. It provides Layer 7 routing and a WAF feature set but does not alone fulfill the requirement for strictly on-premises IP-based restrictions.