Examkin

Question

Difficulty: MediumConfigure Azure Application Gateway

You configure an Azure Application Gateway v2 to distribute traffic to a backend pool of virtual machines. The web application hosted on the virtual machines requires authentication at the root directory (//) and returns an HTTP 401401 (Unauthorized) response to unauthenticated requests. As a result, the default Application Gateway health probes fail, and the backend pool is marked as unhealthy. You need to ensure the Application Gateway correctly identifies the backend servers as healthy. What should you do?

  1. A
    Add a user-defined route (UDR) to the Application Gateway subnet with the next hop type set to Virtual Network Gateway to redirect probe traffic.
  2. B
    Create an inbound network security group (NSG) rule on the Application Gateway subnet with a priority of 100100 to allow traffic from the Virtual Network Manager service tag.
  3. Create a custom health probe that targets an unauthenticated status endpoint, and associate the probe with the backend settings.Answer
  4. D
    Configure virtual network peering transit settings to allow the health probe traffic to route transitively through an Azure Firewall.

Answer

Create a custom health probe that targets an unauthenticated status endpoint, and associate the probe with the backend settings.
The correct configuration is to create a custom health probe that targets an unauthenticated status endpoint (or accommodates the expected HTTP status code) and associate this probe with the backend settings of the Application Gateway. By default, Application Gateway expects HTTP status codes between 200200 and 399399. An application-level authentication requirement returning HTTP 401401 will cause the default probe to fail, which is resolved by pointing the probe to a bypass or health-check page.

Step-by-Step Solution

1
Analyze the health probe failure.
The default health probe targets the root path (//) and expects an HTTP status code between 200200 and 399399. Because the root path requires authentication, it returns an HTTP 401401 code, which the gateway interprets as unhealthy.
Understanding why the default probe fails is necessary to determine the required configuration change.
2
Define a custom health probe configuration.
A custom health probe is defined to target an unauthenticated path (such as a dedicated /health/health page) or configured to accept HTTP 401401 as a healthy response status code.
Custom health probes allow customization of the request path, intervals, and acceptable status code ranges.
3
Associate the custom health probe with the backend settings.
The custom health probe is linked to the backend settings (formerly HTTP settings) of the Application Gateway, which are applied to the backend pool.
Health probes must be associated with the corresponding backend settings to override the default probing behavior.

Key Concept

Configure custom health probes for Azure Application Gateway
Rate this question

Topics

Configure Azure Application Gateway

More questions from this topic