Develop Azure compute solutions →mediumMultiple ChoiceObjective-mapped

AZ-204 Develop Azure compute solutions Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "type": "Microsoft.Web/sites/config",
  "apiVersion": "2022-03-01",
  "name": "[concat(parameters('siteName'), '/web')]",
  "properties": {
    "cors": {
      "allowedOrigins": [
        "https://app.contoso.com",
        "https://portal.contoso.com"
      ],
      "supportCredentials": false
    }
  }
}
```

You find the above ARM template snippet in a deployment. What is the effect of this configuration on the App Service?

⚠ Common exam trap

Many exam-takers confuse `supportCredentials: false` with blocking all cross-origin requests, when in fact it only disallows credentials while still allowing non-credentialed requests from the specified origins.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Allows cross-origin requests from app.contoso.com and portal.contoso.com without credentials.

The ARM template snippet sets `allowedOrigins` to specific domains (`app.contoso.com` and `portal.contoso.com`) and `supportCredentials` to `false`. This configuration allows cross-origin requests from those two origins but does not include credentials (cookies, HTTP authentication, or client-side certificates) in the requests, as per the CORS specification.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Allows cross-origin requests from app.contoso.com and portal.contoso.com without credentials.
Why this is correct
The `allowedOrigins` property explicitly lists `https://app.contoso.com` and `https://portal.contoso.com`, granting these specific domains permission to make cross-origin requests to the App Service. Concurrently, `supportCredentials: false` dictates that the browser should not include credentials, such as cookies, HTTP authentication headers, or client-side SSL certificates, with these permitted cross-origin requests. This configuration enables secure communication from the specified front-end applications to the App Service API without relying on credential-based authentication at the CORS level.
✗
Configures the App Service to require authentication for cross-origin requests.
Why it's wrong here
CORS (Cross-Origin Resource Sharing) is a browser-side security feature that determines *if* a cross-origin request is allowed, not *how* the server authenticates the request. The `supportCredentials` property only controls whether the browser *sends* credentials with a cross-origin request; it does not enforce server-side authentication. Authentication requirements are configured separately within the App Service, for instance, using Azure Active Directory integration or custom API authentication middleware, which are distinct from CORS settings.
✗
Enables CORS for all origins by setting allowedOrigins to a wildcard.
Why it's wrong here
The ARM template snippet explicitly defines `allowedOrigins` with a precise list of domains: `https://app.contoso.com` and `https://portal.contoso.com`. This configuration strictly limits cross-origin access to only these two specified origins. To enable CORS for all origins, the `allowedOrigins` property would need to be set to a wildcard value, typically `["*"]`, which is not present in the provided configuration.
✗
Blocks all cross-origin requests because supportCredentials is false.
Why it's wrong here
Setting `supportCredentials` to `false` does not block all cross-origin requests; instead, it instructs the browser *not* to include credentials (like cookies or HTTP authentication headers) when making requests to the specified origins. The `allowedOrigins` array explicitly permits cross-origin requests from `https://app.contoso.com` and `https://portal.contoso.com`. Therefore, requests from these origins will be allowed, but without any associated credentials, meaning the server cannot rely on them for authentication for these specific CORS requests.

Go deeper

AZ-204 Develop Azure compute solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question