Examkin

Soru

Zorluk: OrtaConfigure Azure Application Gateway

You plan to configure an Azure Application Gateway v2 named AppGw1 to perform SSL termination. The SSL certificates must be stored securely in an Azure Key Vault named KV1.

You need to configure AppGw1 to retrieve the SSL certificates from KV1.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  1. 1Create a user-assigned managed identity.
  2. 2Assign the Key Vault Secrets User role on KV1 to the user-assigned managed identity.
  3. 3Associate the user-assigned managed identity with AppGw1.
  4. 4Create an HTTPS listener on AppGw1 that references the certificate URI in KV1.

Cevap

First, create a user-assigned managed identity. Second, assign the Key Vault Secrets User role on KV1 to the user-assigned managed identity. Third, associate the user-assigned managed identity with AppGw1. Fourth, create an HTTPS listener on AppGw1 that references the certificate URI in KV1.
To configure Azure Application Gateway with SSL certificates from Key Vault, you must first create a user-assigned managed identity. Then, you grant that identity read access (Key Vault Secrets User role) to the Key Vault. Next, you associate the identity with the Application Gateway. Finally, you configure the HTTPS listener on the Application Gateway referencing the Key Vault certificate URI. This ensures the gateway has the credentials and permissions needed to pull the certificate.

Adım Adım Çözüm

1
Create a user-assigned managed identity.
A user-assigned managed identity is created.
The Application Gateway needs a managed identity to authenticate to Key Vault without storing credentials. The identity must be created before it can be assigned permissions or associated with resources.
2
Assign the Key Vault Secrets User role on KV1 to the user-assigned managed identity.
The identity is granted read access to secrets in KV1.
Application Gateway retrieves SSL certificates from Key Vault as secrets. Assigning the Key Vault Secrets User role (or equivalent access policy) ensures the identity has the necessary permission to get the certificate.
3
Associate the user-assigned managed identity with AppGw1.
AppGw1 is updated to reference the user-assigned managed identity.
The Application Gateway must be explicitly configured with the user-assigned managed identity so it knows which identity to present when calling Key Vault.
4
Create an HTTPS listener on AppGw1 that references the certificate URI in KV1.
An HTTPS listener is created and successfully fetches the certificate.
The listener can now be configured to retrieve the certificate from Key Vault. This step must be performed last because the listener setup references the certificate in Key Vault and requires the gateway to already have the associated managed identity.

Anahtar Kavram

Azure Key Vault integration with Azure Application Gateway for SSL termination
Bu soruyu puanla

Konular

Configure Azure Application Gateway

Bu konudan daha fazla soru