An administrator is deploying an Azure Application Gateway v2 (Standard_v2 SKU) in Subnet-GW within VNet-Hub to host two secure websites: partners.contoso.com and internal.contoso.com. Both sites must share the same public IP address on the gateway. The configuration requirements are:
1. partners.contoso.com requires end-to-end SSL encryption. The backend pool contains virtual machines in VNet-Spoke1 (peered to VNet-Hub) defined by FQDNs registered in a private DNS zone named private.contoso.com. These virtual machines use self-signed certificates.
2. internal.contoso.com requires SSL termination at the gateway. The backend pool consists of Azure App Service instances. Requests to internal.contoso.com/images/* must be routed to an Azure Storage account static website.
3. The gateway subnet must be secured using a Network Security Group (NSG) and allow management traffic.
Which of the following configurations must be implemented to meet these requirements?
- AConfigure two multi-site HTTPS listeners: one for partners.contoso.com and one for internal.contoso.com. For partners.contoso.com, create a basic routing rule to the VM backend pool, set the backend protocol to HTTPS, upload the self-signed certificate (.cer) as a Trusted Root Certificate, and link VNet-Spoke1 to the private.contoso.com private DNS zone while leaving VNet-Hub unlinked. For internal.contoso.com, create a path-based routing rule with a default target pointing to the App Service backend pool, set the backend protocol to HTTP, enable host header override in the HTTP settings, and define a path map for /images/* pointing to the storage account backend pool. Apply an NSG to Subnet-GW with an inbound rule allowing GatewayManager traffic on ports - at priority .
- BConfigure two multi-site HTTPS listeners: one for partners.contoso.com and one for internal.contoso.com. For partners.contoso.com, create a basic routing rule to the VM backend pool, set the backend protocol to HTTPS, upload the self-signed certificate (.cer) as a Trusted Root Certificate, and link VNet-Hub to the private.contoso.com private DNS zone. For internal.contoso.com, create a path-based routing rule with a default target pointing to the App Service backend pool, set the backend protocol to HTTP, enable host header override in the HTTP settings, and define a path map for /images/* pointing to the storage account backend pool. Configure a User-Defined Route (UDR) in Subnet-GW for with the next hop type set to Virtual Network Gateway to force all outbound internet traffic through an on-premises security appliance.
- Configure two multi-site HTTPS listeners: one for partners.contoso.com and one for internal.contoso.com. For partners.contoso.com, create a basic routing rule to the VM backend pool, set the backend protocol to HTTPS, upload the self-signed certificate (.cer) as a Trusted Root Certificate, and link VNet-Hub to the private.contoso.com private DNS zone. For internal.contoso.com, create a path-based routing rule with a default target pointing to the App Service backend pool, set the backend protocol to HTTP, enable host header override in the HTTP settings, and define a path map for /images/* pointing to the storage account backend pool. Apply an NSG to Subnet-GW with an inbound rule allowing GatewayManager traffic on ports - at priority .Cevap
- DConfigure two multi-site HTTPS listeners: one for partners.contoso.com and one for internal.contoso.com. For partners.contoso.com, create a basic routing rule to the VM backend pool, set the backend protocol to HTTPS, upload the self-signed certificate (.cer) as a Trusted Root Certificate, and link VNet-Hub to the private.contoso.com private DNS zone. For internal.contoso.com, create a path-based routing rule with a default target pointing to the App Service backend pool, set the backend protocol to HTTP, enable host header override in the HTTP settings, and define a path map for /images/* pointing to the storage account backend pool. Apply an NSG to Subnet-GW with an inbound rule allowing GatewayManager traffic on ports - at priority , which is lower precedence than a custom inbound deny-all rule set at priority .
Cevap
The correct configuration requires configuring two multi-site HTTPS listeners, linking VNet-Hub to the private DNS zone, overriding the backend host name for the App Service pool, using HTTPS with a Trusted Root Certificate for the VM pool, and applying a high-precedence inbound NSG rule on Subnet-GW allowing GatewayManager traffic.
The correct configuration addresses all requirements: (1) multi-site listeners are used for hosting multiple domains on the same IP and port; (2) VNet-Hub is linked to the private DNS zone so the gateway can resolve the VM backend pool's FQDNs; (3) backend HTTP settings use HTTPS with a Trusted Root Certificate for the VM pool, and HTTP with host header override for the multi-tenant App Service; (4) a path-based routing rule is configured for the site requiring path mapping; (5) the NSG allows GatewayManager traffic on ports - with higher precedence (lower priority number) than any deny rule.
Adım Adım Çözüm
Anahtar Kavram
Azure Application Gateway v2 configuration including multi-site listeners, path-based routing, backend certificate trust, DNS resolution dependencies, and subnet NSG requirements.
Tahmini Süre:3m 0s