AZ-700 Question 220
Single answerYou manage an Azure Application Gateway that sits in front of a set of microservices hosted on VMs. Your organization wants to offload SSL/TLS at the Application Gateway while also ensuring traffic to the backend pool remains encrypted (end-to-end encryption). Which of the following steps must be taken to properly configure SSL termination at the gateway and maintain secure traffic to the backend?
- A
A. Enable SSL offload on the frontend listener but disable HTTPS on the backend pool to reduce complexity
- B
B. Configure the frontend to use a publicly trusted certificate, then upload and reference the backend certificate in the Application Gateway� HTTP settings for SSL bridging
- C
C. Require client certificates at the gateway and allow the gateway to pass the validated traffic as HTTP to the backends
- D
D. Use a self-signed certificate on the Application Gateway and rely on the default TLS settings for the backend
Show answer and explanation
Correct answer: B
Explanation
In an end-to-end SSL scenario (SSL bridging), Azure Application Gateway terminates SSL at the gateway while re-establishing a secure session to the backend pool. According to Microsoft documentation, you must install a trusted certificate on the Application Gateway for client-facing SSL termination, then configure HTTPS in the backend HTTP settings with the backend� certificates. This setup ensures encrypted traffic from the client to the gateway, and from the gateway to the backend services.
- A. Incorrect.
A. Incorrect. Simply enabling SSL offload on the frontend listener without configuring HTTPS on the backend pool means traffic from the gateway to the backend would be sent unencrypted, which does not meet the end-to-end encryption requirement.
- B. Correct.
B. Correct. To achieve SSL termination at the gateway and maintain encryption to the backend, you must configure the gateway� frontend listener with a publicly trusted certificate and also upload and configure the backend certificate through the Application Gateway� HTTP settings. This ensures that traffic from clients to the gateway is encrypted (offload at the gateway) and then re-encrypted from the gateway to the backend services (SSL bridging).
- C. Incorrect.
C. Incorrect. Requiring client certificates at the gateway only verifies client identity. If you then pass traffic as HTTP to the backend, you lose your encryption from the gateway to the backend, violating end-to-end encryption requirements.
- D. Incorrect.
D. Incorrect. Using a self-signed certificate on the gateway is valid for testing but would not likely be trusted by external clients, and relying only on the default TLS settings to secure the backend without the proper configuration does not guarantee encryption from the gateway to the backend.