Examkin

Question

Difficulty: HardConfigure Azure Application Gateway

You plan to configure an Azure Application Gateway v2 to support end-to-end TLS encryption for a backend pool of web servers. The backend servers use self-signed certificates for their TLS configurations. You have already created the Application Gateway, the frontend public IP address, and the backend pool.

You need to complete the end-to-end TLS configuration so that the Application Gateway can securely receive traffic from clients and securely transmit it to the backend pool.

Which sequence of actions should you perform? To answer, arrange the actions in the correct order.

  1. 1Export the public certificate (.cer) from the backend web servers.
  2. 2Create Backend Settings using the HTTPS protocol, and upload the exported backend certificate.
  3. 3Create a custom HTTPS health probe and associate it with the HTTPS Backend Settings.
  4. 4Create an HTTPS listener and associate it with the frontend SSL certificate.
  5. 5Create a request routing rule that binds the HTTPS listener, the Backend Settings, and the backend pool.

Answer

Export the public certificate (.cer) from the backend web servers, then create Backend Settings using the HTTPS protocol and upload the exported backend certificate, then create a custom HTTPS health probe and associate it with the HTTPS Backend Settings, then create an HTTPS listener and associate it with the frontend SSL certificate, and finally create a request routing rule that binds the HTTPS listener, the Backend Settings, and the backend pool.
The correct sequence starts by exporting the backend certificate so that it can be uploaded during the creation of the HTTPS Backend Settings to establish trust. Once the Backend Settings are created, a custom HTTPS health probe is associated with them. The HTTPS listener is then created to receive client-side TLS connections. Finally, the routing rule binds the listener, the Backend Settings, and the backend pool together.

Step-by-Step Solution

1
Export the public certificate from the backend servers.
You obtain the public key (.cer) file for the self-signed certificate used by the backend.
Azure Application Gateway v2 requires the public certificate of self-signed backends to be uploaded to establish backend trust.
2
Create the Backend Settings and upload the certificate.
Backend Settings are created with the HTTPS protocol on port 443, with the exported certificate configured as a Trusted Root Certificate.
This establishes trust between the Application Gateway and the backend pool servers.
3
Create and associate a custom HTTPS health probe.
A health probe is created using the HTTPS protocol and is linked to the newly created Backend Settings.
The gateway must use HTTPS to perform health probes to match the secure backend configuration.
4
Create an HTTPS listener.
A listener is configured with the frontend public IP, port 443, and the frontend SSL certificate.
This enables the Application Gateway to receive encrypted HTTPS traffic from public clients.
5
Create a request routing rule.
A routing rule is created that maps the HTTPS listener to the backend pool using the HTTPS Backend Settings.
The routing rule ties all the components together, defining the logical traffic flow.

Key Concept

Configuring end-to-end TLS on Azure Application Gateway v2 requires establishing trust by uploading the backend's public certificate to the Backend Settings, setting up a custom HTTPS health probe, configuring an HTTPS listener with a frontend certificate, and linking them via a routing rule.
Rate this question

Topics

Configure Azure Application Gateway

More questions from this topic