Examkin

Question

Difficulty: Very hardConfigure Azure App Services

An administrator is configuring a new Azure App Service web app named app-finance-prod that runs on a Premium V3 App Service plan. The administrator must implement the following requirements:
1. The web app must connect to an Azure SQL database using a private endpoint located in a subnet named db-subnet inside a virtual network named VNet1. Outbound database traffic from the web app must be secured.
2. The custom application settings and database connection strings must remain specific to the production environment and must not be copied or swapped when deploying updates via a deployment slot named staging.
3. To resolve the database's private endpoint FQDN, the web app must use a private DNS zone named privatelink.database.windows.net.

Which three configurations should the administrator perform?

  1. Configure regional virtual network integration for app-finance-prod using a dedicated subnet in VNet1 that is delegated to Microsoft.Web/serverFarms.Answer
  2. Link the private DNS zone privatelink.database.windows.net to VNet1.Answer
  3. Configure the database connection string as a deployment slot setting on app-finance-prod.Answer
  4. D
    Scale down the App Service Plan to the Basic B1 pricing tier to reduce costs during the setup phase.
  5. E
    Deploy the regional virtual network integration for app-finance-prod directly into db-subnet.

Answer

Configure regional virtual network integration using a dedicated subnet in VNet1, link the private DNS zone to VNet1, and configure the database connection string as a deployment slot setting.
To secure outbound database traffic, the web app must utilize regional virtual network integration, which requires a dedicated subnet in the target virtual network. To resolve the private IP of the database private endpoint, the corresponding private DNS zone must be linked to the virtual network. Finally, to ensure database connection strings do not swap when deploying changes from the staging slot, the setting must be configured as a deployment slot setting.

Step-by-Step Solution

1
Ensure the App Service Plan tier supports required features.
Confirm the Premium V3 tier is active, as deployment slots and VNet integration are required.
Lower tiers like Basic B1 do not support deployment slots.
2
Configure outbound connectivity from the App Service.
Enable regional VNet Integration using a dedicated subnet in VNet1 delegated to Microsoft.Web/serverFarms.
This allows outbound web app traffic to access the database private endpoint in the VNet.
3
Set up private DNS resolution for the integrated VNet.
Link the private DNS zone privatelink.database.windows.net to VNet1.
Ensures the web app resolves the Azure SQL Database FQDN to its private IP address.
4
Protect configuration settings from swapping.
Mark the database connection string as a deployment slot setting.
This makes the setting sticky to the production slot so it does not get replaced during a slot swap.

Key Concept

Azure App Service Hybrid Networking and Deployment Slot Configuration
Rate this question

Topics

Configure Azure App Services

More questions from this topic