Examkin

Question

Difficulty: HardConfigure Azure Application Gateway

A cloud engineer needs to configure a single Azure Application Gateway v2 with one public frontend IP address to host two secure websites: `partners.contoso.com` and `customers.contoso.com`. Both websites must be accessible over HTTPS on port 443. Traffic to `partners.contoso.com/orders/*` must be routed to a backend pool named `PartnerOrdersPool`, while all other traffic for both websites must be routed to `DefaultWebPool`. Which configuration should the administrator implement?

  1. Configure a multi-site listener for each domain on port 443. Associate the listener for partners.contoso.com with a routing rule that uses a path map to route /orders/* traffic to PartnerOrdersPool and default traffic to DefaultWebPool. Associate the listener for customers.contoso.com with a routing rule that sends all traffic directly to DefaultWebPool.Answer
  2. B
    Configure a basic listener for each domain on port 443. Associate both listeners with a routing rule that routes all traffic to DefaultWebPool. Create a Private DNS Zone named contoso.com and link it to the virtual network to handle name resolution.
  3. C
    Configure a basic listener on port 443. Associate it with a routing rule that directs traffic to DefaultWebPool. Configure a Network Security Group on the Application Gateway subnet with an inbound rule allowing port 443 at priority 4000 and an inbound deny rule at priority 1000.
  4. D
    Configure a multi-site listener on port 443 using a wildcard host header *.contoso.com. Associate it with a routing rule that uses a path map. Configure a user-defined route on the Application Gateway subnet with a next hop type of Virtual Network Gateway to route traffic to the backend pools.

Answer

Configure a multi-site listener for each domain on port 443. Associate the listener for partners.contoso.com with a routing rule that uses a path map to route /orders/* traffic to PartnerOrdersPool and default traffic to DefaultWebPool. Associate the listener for customers.contoso.com with a routing rule that sends all traffic directly to DefaultWebPool.
To host multiple websites on the same port and frontend IP address of an Azure Application Gateway, multi-site listeners must be configured with unique hostnames. The listener for the domain requiring path-based routing is associated with a routing rule that uses a path map to direct specific URLs to one backend pool and all other traffic to the default pool. The listener for the other domain, which requires no path-specific routing, is associated with a standard basic routing rule pointing to the default pool.

Step-by-Step Solution

1
Determine the listener type required for hosting multiple domains on the same IP and port.
Identify that multi-site listeners must be used, specifying the host headers partners.contoso.com and customers.contoso.com respectively.
Basic listeners do not support host headers and cannot share the same IP and port combination.
2
Configure routing rules based on path requirements.
Associate the partners.contoso.com listener with a path-based routing rule, mapping /orders/* to PartnerOrdersPool and the default path to DefaultWebPool. Associate the customers.contoso.com listener with a basic routing rule routing to DefaultWebPool.
One domain requires path-specific redirection, while the other maps all inbound requests directly to the default backend pool.
3
Ensure that surrounding network routing and security group rules do not interfere with Application Gateway operations.
Avoid placing UDRs on the gateway subnet targeting backend pools, and ensure NSG priorities allow port 443 and gateway communication.
Application Gateway handles backend distribution internally, and wrong NSG priorities or UDR routes will block or misroute the traffic.

Key Concept

Configuring Multi-site Listeners and Path-based Routing Rules on Azure Application Gateway
Estimated Time:2m 30s
Rate this question

Topics

Configure Azure Application Gateway

More questions from this topic