AZ-700 Azure Application Gateway and WAF 2 — Questions and Answers
Question 1: What is the primary benefit of enabling SSL offloading on Azure Application Gateway?
- Encrypting traffic between the gateway and backend servers
- Terminating SSL/TLS at the gateway to reduce backend server CPU overhead (Correct answer)
- Generating SSL certificates automatically for backend servers
- Routing traffic based on SSL certificate Common Name attributes
Correct answer: Terminating SSL/TLS at the gateway to reduce backend server CPU overhead
SSL offloading terminates the SSL/TLS connection at the Application Gateway, allowing backend servers to handle unencrypted HTTP traffic and reducing their computational load.
Question 2: What does end-to-end SSL mean in the context of Azure Application Gateway?
- SSL is terminated at the gateway and backends receive plain HTTP
- Traffic is encrypted from the client through the gateway to the backend servers (Correct answer)
- Application Gateway manages SSL certificate lifecycle for all backends
- SSL is only applied between Application Gateway and the internet
Correct answer: Traffic is encrypted from the client through the gateway to the backend servers
End-to-end SSL maintains encrypted HTTPS communication from client to Application Gateway, and the gateway re-encrypts traffic before sending it to backend servers.
Question 3: Which Application Gateway feature allows you to add, remove, or modify HTTP request and response headers as traffic passes through?
- URL path routing
- Custom health probes
- Rewrite rules (Correct answer)
- Backend HTTP settings
Correct answer: Rewrite rules
Rewrite rules allow modification of HTTP request and response headers, as well as URL paths, as traffic flows through Application Gateway.
Question 4: What is the function of a multi-site listener in Azure Application Gateway?
- Accepting traffic on multiple ports simultaneously with one listener
- Routing traffic from multiple hostnames through a single gateway instance (Correct answer)
- Handling both HTTP and HTTPS traffic on a single listener
- Load balancing traffic across multiple Azure regions
Correct answer: Routing traffic from multiple hostnames through a single gateway instance
Multi-site listeners enable hosting multiple web applications on the same Application Gateway by routing based on the host header in HTTP requests.
Question 5: When you configure a URL redirect rule in Application Gateway, what does the gateway send to the client?
- It rewrites the URL path in the forwarded backend request silently
- An HTTP redirect response instructing the browser to navigate to a different URL (Correct answer)
- A TCP reset to force the client to reconnect to a different endpoint
- A proxy response transparently fetching content from the redirect target
Correct answer: An HTTP redirect response instructing the browser to navigate to a different URL
URL redirect sends an HTTP 301 or 302 redirect response to the client, instructing the browser to request a different URL.
Question 6: Which Application Gateway feature allows you to display branded HTML pages instead of default error responses for 403 and 502 status codes?
- WAF custom rules
- Backend health monitoring
- Custom error pages (Correct answer)
- Listener error handling policies
Correct answer: Custom error pages
Application Gateway supports custom error pages for HTTP 403 (WAF block) and 502 (bad gateway) responses, enabling a branded error experience.
Question 7: Which backend member type is supported by Azure Application Gateway backend pools?
- Azure Service Bus queue endpoints
- Virtual machines and VM scale set instances (Correct answer)
- Azure Blob Storage static website URLs
- Azure Event Hub consumer groups
Correct answer: Virtual machines and VM scale set instances
Application Gateway backend pools support virtual machines, VM scale sets, App Service web apps, and on-premises servers accessible via IP or FQDN.
AZ-700 Azure Application Gateway and WAF 2
What is the primary benefit of enabling SSL offloading on Azure Application Gateway?