An organization has a backend API hosted on an Azure App Service web app. You need to restrict inbound network access to the API so that it only accepts traffic originating from a virtual network subnet named Subnet1. Which configuration should you implement?
- AConfigure regional virtual network integration on the App Service pointing to Subnet1.
- Enable the Microsoft.Web service endpoint on Subnet1, and configure a virtual network access restriction rule on the App Service.Answer
- CAssociate a Network Security Group (NSG) containing an inbound security rule to the App Service.
- DConfigure a virtual network peering link between the App Service and Subnet1.
Answer
Enable the Microsoft.Web service endpoint on Subnet1, and configure a virtual network access restriction rule on the App Service.
To restrict inbound traffic to an Azure App Service web app to a specific subnet, you must enable the Microsoft.Web service endpoint on that subnet. This allows the App Service to verify the source subnet of the incoming requests. You then configure a virtual network rule under the Access Restrictions settings of the App Service to permit traffic from that subnet. This blocks all other incoming public IP addresses and subnets.
Step-by-Step Solution
Key Concept
Configuring App Service inbound network security using access restrictions and service endpoints.
Estimated Time:1m 30s