AZ-500 Question 98
Single answerYou have deployed a production web application to Azure App Service using a custom domain and a third-party certificate. Your organization's security policy mandates that only TLS 1.2 connections are allowed and that all HTTP requests are automatically redirected to HTTPS. Which configuration should you apply to meet these requirements?
- A
In the Azure portal, under TLS/SSL settings, set the minimum TLS version to 1.2 and enable 'HTTPS Only' to force all incoming requests over TLS 1.2.
- B
Change the custom domain’s CNAME record to point to the default *.azurewebsites.net domain and rely on the free App Service Managed Certificate without configuring further TLS settings.
- C
Modify the web.config file to manually rewrite HTTP URLs to HTTPS, and ensure TLS 1.1 or higher is enforced through application code.
- D
Use a self-signed certificate with IP-based SSL binding and set the WEBSITE_DISABLE_SSL_ENDPOINTS environment variable to false.
Show answer and explanation
Correct answer: A
Explanation
To properly enforce TLS 1.2 connections on an Azure App Service with a custom domain, you should configure the TLS/SSL settings in the Azure portal by selecting 'Minimum TLS Version = 1.2' and enable 'HTTPS Only.' By doing so, all traffic is redirected to HTTPS, and any attempts at lower TLS versions are refused at the platform level, aligning with best practices for secure communication. For more information, refer to the official Microsoft documentation: https://learn.microsoft.com/azure/app-service/configure-ssl-certificate.
- A. Correct.
Correct. In Azure App Service, you can enforce TLS 1.2 by setting the minimum TLS version under TLS/SSL Settings. Enabling 'HTTPS Only' automatically redirects all HTTP requests to HTTPS, ensuring secure connections.
- B. Incorrect.
Incorrect. Although configuring a CNAME record can route traffic to the App Service, relying solely on the built-in certificate and skipping SSL/TLS configuration in the App Service does not guarantee TLS 1.2 enforcement on your custom domain.
- C. Incorrect.
Incorrect. While using web.config rewrites can help redirect traffic, it does not ensure that the App Service platform itself enforces TLS 1.2. Additionally, manually enforcing TLS in application code is less reliable than configuring it at the platform level.
- D. Incorrect.
Incorrect. Self-signed certificates are not recommended for production workloads. IP-based SSL binding also adds complexity and setting WEBSITE_DISABLE_SSL_ENDPOINTS to false does not configure TLS 1.2 enforcement on Azure App Service.