AZ-800 Application Gateway and WAF 4 — Questions and Answers
Question 1: An Application Gateway health probe is failing for a backend VM even though the VM is running. The probe is configured for HTTPS on port 443 but the VM certificate is self-signed. What setting should be configured to resolve this?
- Set the probe protocol to HTTP instead
- Upload the backend root certificate to HTTP Settings so Application Gateway trusts it (Correct answer)
- Disable TLS on the Application Gateway listener
- Add the VM IP to the WAF exclusion list
Correct answer: Upload the backend root certificate to HTTP Settings so Application Gateway trusts it
When the backend uses a self-signed certificate, you must upload the backend root certificate to HTTP Settings so Application Gateway trusts it during health probes.
Question 2: What happens to in-flight connections to a backend instance when connection draining is enabled and the instance is removed from the backend pool?
- Connections are immediately terminated
- Existing connections continue until they complete or the drain timeout expires (Correct answer)
- New connections are allowed but old ones are reset
- The backend is marked unhealthy but traffic continues indefinitely
Correct answer: Existing connections continue until they complete or the drain timeout expires
Connection draining allows existing connections to a deregistered backend to complete gracefully within a configurable timeout period.
Question 3: An Application Gateway uses end-to-end SSL. The backend servers present certificates issued by a private CA. What must be uploaded to the HTTP Settings to enable the gateway to trust these backend certificates?
- The private key of the CA
- The authentication certificate (root CA certificate) (Correct answer)
- The backend server full certificate chain in PFX format
- The TLS policy version setting
Correct answer: The authentication certificate (root CA certificate)
For end-to-end SSL with private CA-issued backend certs, you upload the root CA certificate (authentication certificate) to the HTTP Settings.
Question 4: Which Application Gateway SKU supports autoscaling based on traffic load without requiring manual instance count management?
- Standard v1
- WAF v1
- Standard_v2 and WAF_v2 (Correct answer)
- Basic SKU only
Correct answer: Standard_v2 and WAF_v2
The Standard_v2 and WAF_v2 SKUs support autoscaling, allowing Application Gateway to automatically adjust capacity based on traffic.
Question 5: A company deploys Application Gateway in two availability zones for high availability. Which SKU is required to support zone redundancy?
- Standard v1 with multiple instances
- WAF v1 with zone pinning
- Standard_v2 or WAF_v2 (Correct answer)
- Any SKU with a zone-redundant VNet
Correct answer: Standard_v2 or WAF_v2
Zone redundancy for Application Gateway is only supported on the v2 SKU family (Standard_v2 and WAF_v2).
Question 6: A health probe is configured with a timeout of 30 seconds and an interval of 10 seconds. After how many consecutive probe failures does Application Gateway mark the backend as unhealthy by default?
- 1
- 2
- 3 (Correct answer)
- 5
Correct answer: 3
The default unhealthy threshold for Application Gateway health probes is 3 consecutive failures before a backend is marked unhealthy.
Question 7: An architect wants to use a TLS 1.3-only policy on an Application Gateway v2. Which predefined SSL policy should be selected?
- AppGwSslPolicy20150501
- AppGwSslPolicy20170401S
- AppGwSslPolicy20220101 (Correct answer)
- AppGwSslPolicy20150501S
Correct answer: AppGwSslPolicy20220101
The AppGwSslPolicy20220101 predefined policy supports TLS 1.3 and is the most current policy available for Application Gateway v2.
AZ-800 Application Gateway and WAF 4
An Application Gateway health probe is failing for a backend VM even though the VM is running.
The probe is configured for HTTPS on port 443 but the VM certificate is self-signed.
What setting should be configured to resolve this?