Examkin

Question

Difficulty: Very hardConfigure Azure App Services

An administrator is configuring a custom domain named portal.contoso.com for an Azure App Service web app named app-portal-prod. To secure the backend databases, the administrator configures a Private Endpoint for the web app and disables public network access. The administrator needs to secure the custom domain portal.contoso.com using a TLS/SSL certificate. The certificate must support automatic renewal to minimize administrative overhead. Which configuration should the administrator implement to secure the custom domain while meeting the security and renewal requirements?

  1. Configure the custom domain using DNS TXT record validation, and bind a custom TLS/SSL certificate imported from Azure Key Vault with certificate auto-rotation enabled.Answer
  2. B
    Create a free Azure App Service Managed Certificate for the custom domain and configure SNI-based SSL binding.
  3. C
    Configure regional VNet Integration for the web app, and configure a Private DNS Zone link to verify the domain ownership.
  4. D
    Generate a self-signed certificate, upload it directly to the App Service TLS/SSL settings, and enable the App Service auto-renew setting.

Answer

Configure the custom domain using DNS TXT record validation, and bind a custom TLS/SSL certificate imported from Azure Key Vault with certificate auto-rotation enabled.
Configuring the custom domain using DNS TXT records allows the control plane to verify ownership. Binding a custom certificate from Azure Key Vault with auto-rotation enabled satisfies the requirement for automatic renewal. Since public network access is disabled, the public Certificate Authority cannot reach the web app to perform the HTTP-01 challenge needed for issuing or renewing a free App Service Managed Certificate. Azure Key Vault manages the certificate lifecycle independently and syncs it to the App Service automatically.

Step-by-Step Solution

1
Analyze the web app network security status.
The web app has public network access disabled and uses a Private Endpoint.
This restricts inbound HTTP/HTTPS traffic to the private network, meaning the web app is not reachable from the public internet.
2
Evaluate the custom domain verification requirement.
Domain ownership must be verified using a DNS TXT record.
Because the web app cannot receive public HTTP traffic, standard HTTP-based validation cannot be performed.
3
Evaluate certificate validation limitations.
Azure App Service Managed Certificates cannot be used.
Managed certificates require public HTTP-01 challenge verification. Since public access is disabled, the public Certificate Authority cannot reach the app to verify the domain during creation or renewal.
4
Determine the correct certificate and automation method.
Import a custom TLS/SSL certificate from Azure Key Vault with auto-rotation enabled.
Key Vault handles the renewal process externally, and App Service automatically syncs the rotated certificate from Key Vault without requiring public inbound access.

Key Concept

Configuring custom domains and TLS/SSL certificates for network-isolated Azure App Services.
Estimated Time:3m 0s
Rate this question

Topics

Configure Azure App Services

More questions from this topic