Examkin

Question

Difficulty: Very hardConfigure and Manage Azure CDN Endpoints and Caching Rules

An administrator needs to configure an Azure CDN Standard from Microsoft endpoint to use a custom domain secured with a custom TLS certificate stored in Azure Key Vault. The configuration must be completed successfully with minimum delay, and all validation checks must succeed. What is the correct order of steps to configure the custom domain and TLS certificate?

  1. 1Register the Azure CDN service principal in Microsoft Entra ID using the CLI or PowerShell.
  2. 2Configure an Azure Key Vault access policy to grant the Azure CDN service principal Get permissions for certificates and secrets.
  3. 3Create a DNS CNAME record that maps the custom domain to the CDN endpoint hostname.
  4. 4Add the custom domain to the Azure CDN endpoint in the Azure Portal.
  5. 5Enable HTTPS on the custom domain, select the option to use your own certificate, and select the Key Vault, secret, and version.

Answer

The correct order is: (1) Register the Azure CDN service principal in Microsoft Entra ID. (2) Configure the Key Vault access policy to grant the service principal permissions. (3) Create the DNS CNAME record. (4) Add the custom domain to the CDN endpoint. (5) Enable HTTPS on the custom domain and select the certificate from Key Vault.
The configuration must follow a strict dependency path: The Azure CDN service principal must be registered in Microsoft Entra ID first so that it can be granted access to the Key Vault. The DNS CNAME record must be created prior to adding the custom domain to the CDN endpoint to pass the domain ownership validation check. Finally, once the custom domain is registered and Key Vault permissions are established, HTTPS can be enabled using the custom certificate.

Step-by-Step Solution

1
Register the Azure CDN service principal in Microsoft Entra ID using the CLI or PowerShell.
The Azure CDN service principal identity is created and recognized within the tenant.
The service principal must exist in the directory before you can reference it in Key Vault access policies.
2
Create a Key Vault access policy that grants the Azure CDN service principal Get permissions for certificates and secrets.
Azure CDN is authorized to retrieve certificates from the Key Vault.
Azure CDN needs these permissions to fetch and install the custom TLS certificate on the CDN edge servers.
3
Create a CNAME record with your DNS provider mapping the custom domain to the CDN endpoint.
DNS requests for the custom domain are routed to the CDN endpoint.
Azure CDN performs validation against the DNS CNAME record when adding the custom domain to ensure domain ownership.
4
Add the custom domain to the Azure CDN endpoint in the Azure Portal.
The custom domain is associated with the endpoint.
The domain must be associated with the endpoint before HTTPS can be configured for it.
5
Enable HTTPS on the custom domain, select 'Use my own certificate', and select the Key Vault, secret, and version.
The custom domain is secured with the custom TLS certificate.
This is the final step where Azure CDN retrieves the TLS certificate from Key Vault and deploys it to the edge nodes.

Key Concept

Configuring custom domains and TLS certificates from Azure Key Vault on Azure CDN endpoints.
Rate this question

Topics

Configure and Manage Azure CDN Endpoints and Caching Rules