AZ-700 Question 189
Select 3An e-commerce company plans to use Azure Application Gateway to front multiple containerized microservices hosted in Azure Kubernetes Service (AKS). They want to achieve the following objectives: (1) route incoming requests to the appropriate microservice based on the path (e.g., /orders, /inventory), (2) offload SSL processing to a centralized location, and (3) protect their application from the OWASP Top 10 vulnerabilities. Which three Application Gateway features should you configure to meet these requirements?
- A
Path-based routing
- B
SSL offload
- C
Connection draining
- D
Web Application Firewall (WAF)
- E
URL-based translation
Show answer and explanation
Correct answers: A, B, D
Explanation
Azure Application Gateway supports features that map directly to key business requirements. Path-based routing directs incoming requests to different back-end pools based on URL paths. SSL offload centralizes certificate management at the Application Gateway, offloading cryptographic work from the back-end servers. The Web Application Firewall (WAF) feature includes rules to protect against major web exploits, aligning with the requirement to mitigate common vulnerabilities as outlined by the OWASP Top 10. For more information, see the official Azure Application Gateway documentation at https://learn.microsoft.com/azure/application-gateway/overview.
- A. Correct.
Path-based routing is correct because it allows the gateway to direct traffic to different back-end pools based on URL paths. This meets the first requirement of routing requests to the appropriate microservice based on path segments.
- B. Correct.
SSL offload is correct because it lets the Application Gateway handle TLS/SSL termination, simplifying certificate management and reducing the workload on the back-end servers. This meets the second requirement for centralized SSL processing.
- C. Incorrect.
Connection draining is incorrect in this context. While connection draining helps gracefully remove a back-end instance from rotation, it does not address path-based routing, SSL offload, or protection against common web attacks.
- D. Correct.
Web Application Firewall (WAF) is correct because it provides protection against various vulnerabilities, including the OWASP Top 10. This meets the third requirement for enhanced security.
- E. Incorrect.
URL-based translation is incorrect. Azure Application Gateway provides path-based routing and URL redirection or rewriting, but there is no feature called 'URL-based translation' in this context. This option is a distractor referring to a non-existent or misunderstood capability.