AZ-700 Question 226
Select 2You manage an Azure Application Gateway fronting a web application. You need to enforce secure connections (HTTPS) for all inbound traffic and centrally redirect any HTTP requests to HTTPS. Additionally, if users access the path '/legacy', it should serve the content from '/modern' on the backend without requiring the user to change the URL. Which two actions should you take within Application Gateway to fulfill these requirements?
- A
- Create a new HTTP listener that issues a 301 redirect to the HTTPS listener, and implement a rewrite rule to replace '/legacy' with '/modern' in the request path.
- B
- Modify the WAF policy to block port 80 traffic so users must explicitly enter 'HTTPS' in their browser.
- C
- Add a path-based rule matching '/legacy' and override it to '/modern', and enable a redirect from HTTP to HTTPS at the listener level.
- D
- Configure an inbound NAT rule to forward all port 80 traffic to port 443, and rely on backend application code to rewrite '/legacy' to '/modern'.
Show answer and explanation
Correct answers: A, C
Explanation
Azure Application Gateway supports a redirect feature on HTTP listeners and rewrite rules or path-based overrides to transform incoming URLs. By configuring a dedicated HTTP listener that automatically redirects traffic to HTTPS and defining rewrite or path-based rules to substitute '/legacy' with '/modern', you meet both security and content-routing requirements. For more details, refer to Microsoft documentation on Application Gateway HTTP settings and redirect configurations�https://learn.microsoft.com/azure/application-gateway/configuration-overview and https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers.
- A. Correct.
Option 1 is correct. An HTTP listener with a 301 redirect sends all HTTP traffic to HTTPS, removing the need for users to manually update URLs. A rewrite rule can then replace '/legacy' with '/modern' at the gateway level, fulfilling both the security and path-rewrite requirements.
- B. Incorrect.
Option 2 is incorrect. Blocking traffic on port 80 solely prevents HTTP access rather than redirecting it to HTTPS, and it does not address rewriting '/legacy' to '/modern'. Users would receive errors instead of being automatically redirected.
- C. Correct.
Option 3 is correct. A path-based rule can match requests to '/legacy' and override the path to '/modern' before forwarding to the backend pool. Also, enabling a redirect at the listener converts all HTTP requests to HTTPS, providing a unified secure entry point.
- D. Incorrect.
Option 4 is incorrect. Inbound NAT rules are typically used with Azure Load Balancer, not Application Gateway. This setup would bypass native Application Gateway redirection and rewriting features, offloading both tasks to the application code instead of handling them at the networking layer.