Examkin

Question

Difficulty: HardConfigure Azure Application Gateway

An administrator is configuring an Azure Application Gateway v2 named `AppGW1` in a subnet named `AppGWSubnet` within `VNet1`. `AppGW1` must load balance traffic for two internal web applications: `app1.contoso.com` and `app2.contoso.com`.

The backend virtual machines for both applications are deployed in a peered virtual network named `VNet2`. The virtual machines are registered using private Fully Qualified Domain Names (FQDNs) in a private DNS zone named `private.contoso.com`.

You need to ensure that `AppGW1` can resolve the backend FQDNs, route inbound traffic to the correct backend pool based on the requested domain, and maintain communication with Azure management infrastructure.

Which two configurations should you perform? (Select two.)

  1. Link the private DNS zone `private.contoso.com` to `VNet1`.Answer
  2. Configure two multi-site listeners for `app1.contoso.com` and `app2.contoso.com`, and associate each listener with a separate basic routing rule.Answer
  3. C
    Rely on the virtual network peering connection between `VNet1` and `VNet2` to automatically propagate DNS resolution for `private.contoso.com` to `VNet1` without linking the zone.
  4. D
    Associate a user-defined route table to `AppGWSubnet` with a default route (0.0.0.0/00.0.0.0/0) pointing to a virtual appliance in `VNet2` as the next hop.
  5. E
    In the custom Network Security Group (NSG) associated with `AppGWSubnet`, add an inbound rule at priority 100 that denies all traffic from the `GatewayManager` service tag.

Answer

Link the private DNS zone `private.contoso.com` to `VNet1`, and configure two multi-site listeners for `app1.contoso.com` and `app2.contoso.com` with separate basic routing rules.
Linking the private DNS zone to the virtual network containing the Application Gateway ensures proper name resolution of the backend pools. Additionally, configuring multi-site listeners allows the gateway to host multiple unique domain names on a single public IP and route them to their respective backend pools.

Step-by-Step Solution

1
Examine the DNS requirements for the backend pools.
The Application Gateway must resolve backend pool FQDNs registered in the private DNS zone. Since the gateway resides in VNet1, the private DNS zone must be linked to VNet1.
By default, virtual network peering does not share DNS resolution for Azure Private DNS Zones. A virtual network link is required for any VNet whose resources need to resolve names in that private zone.
2
Determine the type of listener needed for the custom domains.
Create two multi-site listeners: one for `app1.contoso.com` and one for `app2.contoso.com`.
A basic listener accepts traffic for any host header on a single port. Hosting multiple distinct web domains on a single public IP address requires multi-site listeners to differentiate traffic based on the requested host headers.
3
Verify network routing and security group rules for the gateway subnet.
Ensure there are no UDRs routing all outbound traffic (0.0.0.0/00.0.0.0/0) to a virtual appliance, and ensure inbound traffic from the GatewayManager service tag is allowed.
Application Gateway v2 requires direct outbound internet connectivity for health monitoring and backend responses. Blocking GatewayManager inbound traffic or routing all internet traffic via a virtual appliance breaks gateway operations.

Key Concept

Azure Application Gateway v2 listener configuration, subnet integration, and DNS link requirements for peered VNets.
Rate this question

Topics

Configure Azure Application Gateway

More questions from this topic