AZ-500 Question 89
Select 2Your organization hosts multiple internal web applications in an ILB App Service Environment (ASE). You need to ensure that only traffic originating from your on-premises network and a specific Azure virtual network can access these web apps, while blocking all other inbound requests. Which two actions should you perform to meet these requirements?
- A
Configure an NSG on the ASE subnet to allow inbound traffic only from the on-premises IP range and the approved Azure subnet, blocking other sources.
- B
Enable the built-in Access Restrictions for each web app to accept traffic only from the on-premises IP range and the approved Azure subnet.
- C
Set up a forced tunnel to direct all Internet-bound traffic from the ASE through your on-premises data center.
- D
Enable public access for each web app and rely on custom application-level authentication controls.
Show answer and explanation
Correct answers: A, B
Explanation
To tightly control inbound traffic to an ILB App Service Environment, you typically combine network-level restrictions with app-level controls. First, apply an NSG to the subnet where the ASE resides to allow connections only from the on-premises IP addresses and the approved Azure subnet. Second, enable Access Restrictions on each web app to further limit incoming requests to those same trusted sources. This layered approach follows Azure best practices, as described in Microsoft’s documentation (e.g., ‘Secure an ILB ASE’ and ‘Configure Access Restrictions for Azure App Service’).
- A. Correct.
Correct. Configuring an NSG with rules that allow traffic solely from your on-premises IP range and the specified Azure subnet (and denying everything else) ensures that only those sources can reach the ASE subnet directly. This is a standard way to lock down inbound connectivity in an ILB ASE scenario.
- B. Correct.
Correct. In addition to NSG rules at the subnet level, you can apply Access Restrictions on each web app to limit inbound requests to specific IP ranges. This built-in feature lets you enforce additional controls for each web app, complementing the NSG configuration.
- C. Incorrect.
Incorrect. While forcing all outbound Internet traffic from the ASE through the on-premises environment can be part of a secure egress strategy, it does not control inbound IP filtering for your internal applications. It does not help with restricting which networks can reach the web apps directly.
- D. Incorrect.
Incorrect. Leaving the apps publicly accessible conflicts with the requirement to restrict inbound requests. Although you could apply custom authentication, this does not solve the need to block all unwanted traffic at the network layer.