AZ-800 Application Gateway and WAF 4

Question 1

An Application Gateway health probe is failing for a backend VM even though the VM is running.
The probe is configured for HTTPS on port 443 but the VM certificate is self-signed.
What setting should be configured to resolve this?

Accepted Answer

Upload the backend root certificate to HTTP Settings so Application Gateway trusts it

Answer

Set the probe protocol to HTTP instead

Answer

Disable TLS on the Application Gateway listener

Answer

Add the VM IP to the WAF exclusion list

Question 2

What happens to in-flight connections to a backend instance when connection draining is enabled and the instance is removed from the backend pool?

Accepted Answer

Existing connections continue until they complete or the drain timeout expires

Answer

Connections are immediately terminated

Answer

New connections are allowed but old ones are reset

Answer

The backend is marked unhealthy but traffic continues indefinitely

Question 3

An Application Gateway uses end-to-end SSL. The backend servers present certificates issued by a private CA. What must be uploaded to the HTTP Settings to enable the gateway to trust these backend certificates?

Accepted Answer

The authentication certificate (root CA certificate)

Answer

The private key of the CA

Answer

The backend server full certificate chain in PFX format

Answer

The TLS policy version setting

Question 4

Which Application Gateway SKU supports autoscaling based on traffic load without requiring manual instance count management?

Accepted Answer

Standard_v2 and WAF_v2

Answer

Standard v1

Answer

WAF v1

Answer

Basic SKU only

Question 5

A company deploys Application Gateway in two availability zones for high availability. Which SKU is required to support zone redundancy?

Accepted Answer

Standard_v2 or WAF_v2

Answer

Standard v1 with multiple instances

Answer

WAF v1 with zone pinning

Answer

Any SKU with a zone-redundant VNet

Question 6

A health probe is configured with a timeout of 30 seconds and an interval of 10 seconds. After how many consecutive probe failures does Application Gateway mark the backend as unhealthy by default?

Accepted Answer

3

Answer

1

Answer

2

Answer

5

Question 7

An architect wants to use a TLS 1.3-only policy on an Application Gateway v2. Which predefined SSL policy should be selected?

Accepted Answer

AppGwSslPolicy20220101

Answer

AppGwSslPolicy20150501

Answer

AppGwSslPolicy20170401S

Answer

AppGwSslPolicy20150501S