AZ-700 Question 206
Select 2You are the network engineer for an online retail platform that uses Azure Application Gateway. Your organization mandates that all inbound connections must use only TLS 1.2 with a restricted set of ciphers for compliance. Additionally, older TLS protocols must be blocked. Which two steps should you perform to meet these requirements?
- A
Modify the Application Gateway's SSL policy to a custom policy specifying TLS 1.2 as the minimum protocol and remove weaker ciphers.
- B
Enable 'SSL 2.0 fallback renegotiation' within the Application Gateway's HTTP settings for backward compatibility with older browsers.
- C
Use the default 'AppGwSslPolicy20150501' policy to automatically enforce TLS 1.2 and modern ciphers.
- D
Associate the custom SSL policy with the front-end HTTP listener to enforce only TLS 1.2 and the specified cipher suite.
Show answer and explanation
Correct answers: A, D
Explanation
To enforce TLS 1.2 and a restricted cipher set on Azure Application Gateway, you create or select a custom SSL policy that enables only TLS 1.2 and removes outdated ciphers, then associate this policy with the front-end listener. This approach follows Azure best practices for secure TLS configurations and ensures no weaker protocols or ciphers are permitted. Refer to Microsoft documentation on �Configure end-to-end TLS with Azure Application Gateway� for guidance on defining and applying custom SSL policies.
- A. Correct.
Correct. Defining a custom SSL policy and setting TLS 1.2 as the minimum protocol ensures that older protocols (TLS 1.0/1.1) are blocked, while removing weaker ciphers locks down the connection further to meet compliance requirements.
- B. Incorrect.
Incorrect. Enabling SSL 2.0 fallback contradicts the requirement to block older protocols. It would allow older, insecure negotiation methods and fail compliance standards.
- C. Incorrect.
Incorrect. The default 'AppGwSslPolicy20150501' policy does not guarantee only TLS 1.2 and may allow older protocols and ciphers. A custom policy is required to strictly enforce TLS 1.2 with a restricted cipher set.
- D. Correct.
Correct. After configuring a custom SSL policy, you must associate it with the appropriate front-end HTTP listener to enforce the selected TLS version and cipher suite on incoming connections.