AZ-700 Question 227
Select 3You have deployed a secure web application using Azure Front Door Premium tier, and you want to ensure that all traffic to your Azure App Service origin remains private and is only accessible through Azure Front Door. You plan to use Azure Private Link to achieve this. Which three steps must you complete to restrict direct public access to the origin while enabling Azure Front Door to communicate using a private endpoint?
- A
Create a private endpoint for your origin in the same region as the origin and place it in the desired virtual network
- B
Enable Private Link in the Azure Front Door origin configuration and select the private endpoint you created
- C
Assign a public IP address to your origin so that Azure Front Door can route traffic without any network restrictions
- D
Enable service endpoints at the origin� subnet to allow direct public traffic over Azure� backbone network
- E
Disable public network access on the App Service (e.g., by updating the App Service� firewall or access restrictions)
Show answer and explanation
Correct answers: A, B, E
Explanation
To secure an origin behind Azure Front Door using Azure Private Link, you must create a private endpoint for the origin and configure Front Door to communicate with it privately. Additionally, you should disable or restrict direct public access to the origin so that all inbound traffic flows through Azure Front Door� Private Link connection. Refer to Microsoft documentation on 'Secure your origins with Private Link in Azure Front Door' for detailed guidance on creating private endpoints and configuring firewall restrictions.
- A. Correct.
Correct. You need to create a private endpoint for your origin (Azure App Service) in the same region as the origin. This links your application privately to your virtual network, preventing direct public connections when properly configured.
- B. Correct.
Correct. When configuring the origin in Azure Front Door, you must enable Private Link and select the private endpoint you created. This ensures that traffic from Azure Front Door to the origin flows privately rather than over the public internet.
- C. Incorrect.
Incorrect. Assigning a public IP to the origin would make it accessible over the public internet, which is exactly what you are restricting by using Private Link.
- D. Incorrect.
Incorrect. Service endpoints are different from private endpoints and do not provide the same level of restricted private access. Relying solely on service endpoints would still allow potential direct public access unless additional restrictions are configured.
- E. Correct.
Correct. Disabling public network access (e.g., by updating the App Service access restrictions or setting firewall rules) ensures that only traffic via the private endpoint (Azure Front Door through Private Link) can connect to the origin.