AZ-700 Question 219
Single answerYou are configuring an Azure Application Gateway to offload SSL at the gateway while maintaining secure communication between the gateway and your web servers. You have uploaded a certificate and configured the front-end listener to terminate SSL. However, traffic fails to flow securely to your back-end pool members. Which action should you take to ensure end-to-end SSL is properly configured?
- A
Install the same public certificate on the back-end servers that is used on the Application Gateway� front-end listener.
- B
Upload the appropriate root or intermediate CA certificate to the Application Gateway and enable HTTPS in the back-end pool settings.
- C
Configure the Application Gateway to operate in a combined HTTP and HTTPS mode for the same listener to ensure both types of traffic are supported.
- D
Disable certificate revocation checks on the Application Gateway to prevent SSL handshake failures and allow traffic flow.
Show answer and explanation
Correct answer: B
Explanation
For an end-to-end SSL configuration with Azure Application Gateway, SSL is first terminated at the gateway, then re-encrypted to the back-end servers. To achieve this, the Application Gateway requires the trusted root or intermediate CA certificate for the back-end server certificates. In Azure documentation, this process is referred to as �end-to-end SSL or SSL bridging.� Refer to the Microsoft Learn documentation (https://learn.microsoft.com/en-us/azure/application-gateway/ssl-overview) for detailed guidance on configuring front-end and back-end certificates.
- A. Incorrect.
Incorrect. While it might seem convenient to reuse the same certificate, Azure Application Gateway requires you to install a trusted root or intermediate certificate to validate the back-end servers� certificates. Simply installing the same public certificate on the back-end servers does not guarantee proper certificate validation and may lead to Domain Name System (DNS) mismatch issues.
- B. Correct.
Correct. For end-to-end SSL with Azure Application Gateway, you must upload the appropriate root or intermediate certificate to the gateway so it can trust and validate the back-end servers' certificates. Then, configure HTTPS as the back-end protocol. This ensures traffic remains encrypted from the gateway to the web servers, fulfilling the end-to-end SSL requirement.
- C. Incorrect.
Incorrect. Configuring a single listener to support both HTTP and HTTPS traffic does not address the need to establish trust with the back-end servers� certificates. You still need to ensure the gateway trusts the certificates used by the back-end servers for HTTPS communication.
- D. Incorrect.
Incorrect. Disabling certificate revocation checks might bypass some handshake errors, but it is not a recommended practice. It undermines security and does not ensure true end-to-end encryption. Proper certificate validation remains critical for secure communication.