AZ-700 Question 187
Single answerYour company is hosting multiple microservices behind a single domain (contoso.com). Each microservice is accessed via a unique path segment (e.g., /catalog, /orders, /reviews), and all traffic must remain encrypted end-to-end. You also need to apply a Web Application Firewall (WAF) policy to protect against common exploits. You have acquired a wildcard SSL certificate (*.contoso.com) for use across your environment. Which configuration strategy in Azure Application Gateway best meets these requirements with minimal complexity?
- A
Use the Standard v2 Application Gateway with path-based rules, upload the wildcard certificate, and terminate SSL at the Application Gateway. Re-encrypt traffic to the backends with a self-signed certificate, but disable the WAF to reduce latency.
- B
Use the WAF v2 Application Gateway, configure a single HTTPS listener with the wildcard certificate, and create path-based rules to route traffic to different backend pools. Deploy valid certificates to the backends to maintain end-to-end SSL.
- C
Use the WAF v2 Application Gateway with one listener per microservice sub-path, each configured with a separate certificate. Enable path-based routing only on the backend if required, and terminate traffic to HTTP at the microservices.
- D
Use the Standard Application Gateway, attach a WAF policy at the subnet level instead of the gateway, and rely on basic routing rules for all microservices under the same domain.
Show answer and explanation
Correct answer: B
Explanation
To achieve end-to-end SSL and WAF protection for multiple microservices on a single domain, you should use the WAF v2 SKU of Application Gateway. A single HTTPS listener can be bound to your wildcard certificate (*.contoso.com) and path-based rules will route requests to the correct backend pools. Each microservice must have SSL certificates installed so that traffic can be re-encrypted, maintaining secure end-to-end communication. For more details, consult the official Microsoft documentation on Azure Application Gateway WAF v2 configuration and end-to-end SSL: https://docs.microsoft.com/azure/application-gateway/overview.
- A. Incorrect.
Option 1 is incorrect because disabling WAF violates the requirement to secure the traffic against common exploits. While it does enable SSL termination and re-encryption, turning off the WAF does not meet the project's compliance and security needs.
- B. Correct.
Option 2 is correct. The WAF v2 SKU supports path-based routing, use of wildcard SSL certificates, and end-to-end encryption. You can configure a single HTTPS listener for contoso.com with the wildcard certificate, apply path-based rules for /catalog, /orders, and /reviews, then ensure each backend also has a valid SSL certificate for re-encryption (thus preserving end-to-end security).
- C. Incorrect.
Option 3 is incorrect because creating multiple listeners, each requiring its own certificate configuration, increases complexity. Additionally, terminating traffic on HTTP at the microservices does not provide end-to-end SSL encryption.
- D. Incorrect.
Option 4 is incorrect because attaching a WAF policy at the subnet level is insufficient for protecting against web vulnerabilities at the HTTP layer, and Standard Application Gateway does not provide a built-in WAF mode. Additionally, it does not specifically address path-based routing for multiple microservices.