AZ-500 Question 90
Select 2You are a security engineer working on a private App Service Environment (ASE) that hosts internal web applications. Your goal is to ensure that only traffic from on-premises via an ExpressRoute connection and authorized Azure resources can reach the web apps. Additionally, you need to inspect and control outbound internet traffic from the ASE. Which two configurations should you implement to meet these requirements?
- A
Associate a Network Security Group (NSG) with the ASE subnet to allow inbound traffic only from authorized IP ranges and block all other inbound addresses.
- B
Redirect outbound traffic from the ASE subnet through an Azure Firewall instance by applying a user-defined route with the default route (0.0.0.0/0) pointed to the firewall.
- C
Enable web app-level IP restrictions in the Azure portal individually for each web app in the ASE to block inbound connections from unknown IP addresses.
- D
Depend on the default NSG rules applied automatically to the ASE subnet, as ILB App Service Environments are fully isolated by default and don't require further inbound firewall rules.
Show answer and explanation
Correct answers: A, B
Explanation
To plan and implement network security for an App Service Environment (ASE), Microsoft documentation recommends using NSGs on the App Service subnet to restrict inbound traffic to authorized IP ranges. To inspect and control outbound traffic, you can define a custom route that sends traffic to a firewall for filtering (forced tunneling). These configurations align with best practices outlined in Azure documentation: https://docs.microsoft.com/azure/app-service/environment/network-info.
- A. Correct.
Correct. Attaching an NSG to the ASE subnet and configuring rules to allow only trusted on-premises IP addresses (via ExpressRoute) or specific Azure services enforces proper inbound security at the subnet level. This is a recommended best practice to control traffic to resources in a private ASE.
- B. Correct.
Correct. Using a user-defined route that forces all outbound traffic through Azure Firewall (or another NVA) allows you to inspect and filter the egress traffic from the ASE. This technique, often called 'forced tunneling,' is commonly used to ensure outbound traffic meets organizational compliance requirements.
- C. Incorrect.
Incorrect. While web app-level IP restrictions can provide granular control, relying exclusively on them for inbound traffic in an ASE scenario is less robust than using NSG-based subnet restrictions. NSGs offer centralized controls for all apps within the environment, reducing configuration overhead and possible misconfigurations.
- D. Incorrect.
Incorrect. An ILB ASE is isolated at the network level, but you still need an NSG or similar mechanism to explicitly allow and deny inbound traffic. The default NSG rules are not sufficient to protect a private ASE because you must actively configure inbound rules that restrict unwanted traffic.