AZ-700 Question 205
Select 2You are deploying an Azure Application Gateway in front of a web application hosted on an Azure App Service with a custom domain. All traffic between clients and the Application Gateway is already secured using HTTPS. You now want to ensure end-to-end TLS from the clients to the Application Gateway and from the Application Gateway to the backend web app. Which two actions should you take to achieve this?
- A
- Upload the PFX certificate (matching the custom domain) to the Application Gateway� HTTPS listener and set up a corresponding HTTPS setting to use TLS for the backend pool.
- B
- Configure the Application Gateway� backend HTTP setting to use HTTP on port 80 for communication with the backend web app.
- C
- Assign a self-signed certificate on the backend web app using a different domain name than the custom domain.
- D
- Configure a custom domain certificate in the backend web app and add the corresponding root certificate to the Application Gateway� trusted root certificates.
Show answer and explanation
Correct answers: A, D
Explanation
In an end-to-end TLS configuration with Azure Application Gateway, you must encrypt traffic from the client to the Application Gateway and again from the gateway to the backend. Storing a valid PFX certificate on the gateway, configuring an HTTPS backend pool, and uploading the root certificate to the gateway� trusted store are critical. This ensures that the Application Gateway can re-encrypt traffic to the backend web app using the correct domain certificate. For more details, see Microsoft documentation on configuring end-to-end SSL with Azure Application Gateway: https://learn.microsoft.com/azure/application-gateway/configuration-end-to-end-ssl.
- A. Correct.
Correct. For end-to-end TLS, you must provide the PFX (containing the private key) to the Application Gateway� HTTPS listener. You also need to configure the HTTP setting to use HTTPS, ensuring encrypted communication with the backend. This setup allows the Application Gateway to decrypt and re-encrypt traffic properly for the custom domain.
- B. Incorrect.
Incorrect. Using HTTP on port 80 for the backend setting would terminate TLS at the Application Gateway, which means the traffic from the gateway to the web app would be unencrypted. This option would not achieve end-to-end TLS.
- C. Incorrect.
Incorrect. A self-signed certificate using a mismatched domain name would break TLS validation. In an end-to-end TLS configuration, the certificate must match the custom domain to avoid certificate errors or failed connections.
- D. Correct.
Correct. When using end-to-end TLS, the backend web app must also serve the same (or a domain-valid) certificate. The root certificate for that certificate must be uploaded to the Application Gateway� trusted root store so that the gateway can properly validate and trust secured traffic to the backend.