AZ-204 Implement Azure security Practice Question
You are deploying a web app to Azure App Service that must use a custom domain with TLS/SSL. You have purchased an SSL certificate from a third-party CA. How should you upload and bind the certificate to the custom domain?
⚠ Common exam trap
Many exam-takers confuse the need for a .pfx file (containing the private key) with a .cer file (public key only), or mistakenly think that placing certificate files in the app's file system is sufficient for TLS/SSL binding, when in fact App Service requires the certificate to be uploaded and bound at the platform level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Upload the .pfx file to the App Service TLS/SSL settings and bind it to the custom domain.
Azure App Service requires a .pfx file containing both the public certificate and the private key to bind a custom domain with TLS/SSL. The .pfx file is uploaded directly in the App Service's TLS/SSL settings, and then the certificate is bound to the custom domain, enabling HTTPS traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place the certificate files in the wwwroot folder of the app and configure the web.config.
Why it's wrong here
Placing certificate files in the wwwroot folder and configuring web.config is an incorrect approach for binding TLS/SSL certificates in Azure App Service. App Service handles TLS termination at the platform level, requiring certificates to be uploaded to its dedicated TLS/SSL settings. Application-level configuration for certificates in web.config is not how the underlying App Service infrastructure establishes secure connections for custom domains, as it bypasses the platform's certificate management system.
- ✗
Import the certificate into Azure Key Vault and reference it from App Service.
Why it's wrong here
While importing certificates into Azure Key Vault and referencing them from App Service is a highly recommended and secure practice for centralized certificate management, it does not directly answer the question of *uploading* the certificate *to App Service* for binding. This method involves a separate Key Vault resource and a different configuration flow, making it an indirect approach compared to a direct upload to the App Service's TLS/SSL settings as implied by the question's context.
- ✗
Upload the .cer file to the App Service and let Azure generate the private key.
Why it's wrong here
Uploading a .cer file is insufficient for establishing a secure TLS connection because this file format contains only the public key of the certificate. For successful TLS/SSL binding and the encryption/decryption of traffic, both the public and the corresponding private key are essential. Azure cannot generate a private key from a public .cer file, rendering this option technically impossible for full TLS functionality required for a custom domain.
- ✓
Upload the .pfx file to the App Service TLS/SSL settings and bind it to the custom domain.
Why this is correct
Uploading the .pfx file directly to the App Service's TLS/SSL settings is the correct and most direct method for binding a custom SSL certificate. The .pfx (Personal Information Exchange) format is a cryptographic standard that securely bundles both the public key certificate and its corresponding private key, which are both critical for establishing a secure TLS connection. Once uploaded, the certificate can then be explicitly bound to the desired custom domain within the App Service configuration portal.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.