Microsoft Certified: Azure Security Engineer AssociateSecure data and applicationsMedium
A global e-commerce company uses Azure App Service to host its regional web applications. The company mandates that all outbound traffic from these web applications to backend services (e.g., databases, other APIs) must be filtered and secured using network security groups (NSGs). The App Service instances are not integrated with a Virtual Network (VNet). Which App Service feature must be configured to meet this requirement?
- AApp Service Access Restrictions.
- BApp Service VNet Integration (Regional).
- CAzure Front Door with WAF.
- DApp Service Private Endpoint.
Show answer & explanationAnswer & explanation
Correct answer: B. App Service VNet Integration (Regional).
App Service VNet Integration (Regional) allows your App Service app to access resources in or through a virtual network. Once integrated, outbound traffic from the App Service can be routed through a subnet within the VNet, enabling the application of Network Security Groups (NSGs) to control the outbound traffic flow.
Why the other options are wrong
- A. App Service Access Restrictions control inbound traffic to the app, not outbound traffic.
- C. Azure Front Door with WAF is primarily for global routing, caching, and inbound web application firewall protection, not for controlling outbound traffic from App Service.
- D. App Service Private Endpoint secures inbound traffic to the App Service from a VNet, not outbound traffic from the App Service.
App Service VNet Integration (Regional)
Allows your App Service app to access resources in or through an Azure Virtual Network (VNet) in the same region. All outbound traffic from the app is then directed through the integrated VNet, enabling network security controls.
- Connects App Service to a VNet in the same region.
- Enables outbound traffic control via NSGs.
- App becomes part of the VNet for outbound connectivity.
Memory trick: VNet Integration is the 'gateway' for App Service to get its outbound traffic secured.