AZ-500 Question 99
Select 2You manage a production web application hosted on Azure App Service using a custom domain. Your organization mandates TLS 1.2 or higher for all incoming connections. You also have Azure API Management configured to serve APIs under the same domain. You want to enable end-to-end encryption with minimal downtime. Which two actions should you take to correctly configure TLS for both the Azure App Service and the Azure API Management service?
- A
Use an Azure App Service managed certificate for the custom domain and export that certificate directly to Azure API Management.
- B
Upload a valid TLS certificate in PFX format to the Azure API Management custom domain settings and point your DNS record to the API Management gateway endpoint.
- C
In the Azure App Service TLS/SSL settings, set the Minimum TLS Version to 1.2 to enforce secure connections.
- D
Enable the legacy TLS 1.0 and 1.1 protocols within Azure API Management so that legacy clients can connect without interruption.
Show answer and explanation
Correct answers: B, C
Explanation
To provide TLS protection for both an Azure App Service and an Azure API Management service under the same custom domain, you must obtain a valid certificate for the custom domain and upload it to each service appropriately, since Azure-managed certificates are not shareable across services. Azure API Management requires a custom certificate in PFX format with the complete certificate chain. Additionally, configuring the App Service to enforce TLS 1.2 ensures older protocols are disabled. For more details, refer to the official Azure documentation on securing custom domains for App Service (https://learn.microsoft.com/azure/app-service/configure-ssl-certificate) and on assigning custom domains and certificates to API Management (https://learn.microsoft.com/azure/api-management/configure-custom-domain).
- A. Incorrect.
Option 1 is incorrect because Azure App Service managed certificates are not exportable to use on another service such as Azure API Management. You must manually procure or generate a certificate for use in API Management.
- B. Correct.
Option 2 is correct. For custom domains in API Management, you need to manually upload a valid certificate (preferably a PFX with the password). You then update the DNS records to point to the API Management gateway, ensuring secure access under the custom domain.
- C. Correct.
Option 3 is correct. Setting the Minimum TLS Version to 1.2 in App Service ensures that older protocols (TLS 1.0 and 1.1) are disallowed, meeting your organization’s security requirement.
- D. Incorrect.
Option 4 is incorrect because enabling TLS 1.0 or TLS 1.1 in Azure API Management does not strengthen security. This would violate the organizational mandate to use TLS 1.2 or higher.