Examkin

Question

Difficulty: Very hardConfigure Azure Application Gateway

An organization is deploying an Azure Application Gateway v2 to load balance traffic across a pool of backend web servers. The security policy requires end-to-end TLS encryption. The backend servers use certificates issued by an internal enterprise Certification Authority (CA). You need to configure the Application Gateway to support this configuration. In which order should you perform the configuration steps?

  1. 1Export the public root certificate of the internal enterprise CA as a Base-64 encoded .cer file.
  2. 2Create a backend pool containing the FQDNs or IP addresses of the backend web servers.
  3. 3Create backend settings configured for HTTPS on port 443 and upload the exported root certificate (.cer) to define it as a trusted root certificate.
  4. 4Upload the frontend certificate as a .pfx file to configure an HTTPS listener.
  5. 5Create a request routing rule to link the HTTPS listener, the backend pool, and the backend settings.

Answer

The correct sequence is: Export the public root certificate of the internal enterprise CA as a Base-64 encoded .cer file; Create a backend pool containing the FQDNs or IP addresses of the backend web servers; Create backend settings configured for HTTPS on port 443 and upload the exported root certificate (.cer); Upload the frontend certificate as a .pfx file to configure an HTTPS listener; and Create a request routing rule to link the HTTPS listener, the backend pool, and the backend settings.
The correct sequence begins with exporting the public root certificate from the enterprise CA (.cer format). This certificate is a dependency for configuring backend settings. Once the backend pool is established, the backend settings can be created with the uploaded root certificate to enable secure communication with backend servers. Next, the frontend HTTPS listener is configured with the frontend certificate (.pfx format). Finally, a request routing rule is created to tie all these components together. This sequence respects all configuration dependencies in Azure.

Step-by-Step Solution

1
Export the public root certificate of the internal enterprise CA.
A Base-64 encoded .cer file containing the public root certificate is generated.
For Application Gateway v2 to trust certificates signed by an internal enterprise CA, the root CA certificate must be uploaded to the gateway. This requires first exporting it in the supported .cer format.
2
Create a backend pool with the backend servers.
A backend pool is defined with backend targets.
The backend pool is a prerequisite component for routing rules and represents the backend servers running the applications.
3
Create backend settings with HTTPS and the uploaded root certificate.
Backend settings are configured to communicate with the backend servers securely.
The backend settings define how traffic is forwarded to the backend. Uploading the trusted root certificate is mandatory for HTTPS on v2 SKU when using non-well-known CA certificates.
4
Upload the frontend certificate (.pfx) and create an HTTPS listener.
An HTTPS listener is established on the frontend IP address.
The listener requires a certificate containing the private key (.pfx format) to decrypt incoming secure traffic from clients.
5
Create a request routing rule.
A routing rule is created associating the listener, backend pool, and backend settings.
The routing rule binds the frontend listener to the backend settings and backend pool, completing the logical flow of traffic through the gateway.

Key Concept

End-to-end TLS configuration with custom/private CA on Azure Application Gateway v2
Estimated Time:3m 0s
Rate this question

Topics

Configure Azure Application Gateway

More questions from this topic