AZ-204 Develop Azure compute solutions Practice Question
Your company runs a web application on Azure App Service that uses a custom domain. The application must be accessible only via HTTPS. You have already uploaded an SSL certificate for the custom domain. However, users can still access the site via HTTP. You need to enforce HTTPS redirection. What should you do?
⚠ Common exam trap
Candidates often think a web.config rewrite rule (Option B) is sufficient, but Azure explicitly recommends the platform-level 'HTTPS Only' setting because it is simpler, more reliable, and works regardless of the application stack (e.g., .NET, Node.js, Python).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the 'HTTPS Only' setting in the App Service's TLS/SSL settings blade.
The 'HTTPS Only' setting in the App Service's TLS/SSL settings blade enforces that all incoming requests are redirected from HTTP to HTTPS at the platform level, before any application code runs. Since you have already uploaded an SSL certificate, enabling this setting ensures that users cannot access the site via HTTP, meeting the requirement without modifying application code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the 'Minimum TLS Version' to 1.2.
Why it's wrong here
Setting the 'Minimum TLS Version' to 1.2 ensures that only connections using TLS 1.2 or higher are accepted by the App Service, enhancing security by preventing older, vulnerable protocol versions. However, this configuration does not inherently redirect unencrypted HTTP traffic to HTTPS. Clients attempting to connect via HTTP will still be served over HTTP if not explicitly redirected, or they might fail if the App Service is configured to reject non-TLS connections entirely, but it won't automatically upgrade their protocol.
- ✗
Add a rewrite rule in the web.config file to redirect HTTP to HTTPS.
Why it's wrong here
Implementing a rewrite rule within the web.config file can indeed redirect HTTP requests to HTTPS. This method relies on the IIS URL Rewrite module and the application stack being active and correctly configured. While functional, it operates at the application level, meaning the request must first reach the web server and be processed by IIS before the redirection occurs, making it less efficient and potentially less robust than a platform-level enforcement.
- ✗
Configure the App Service to require client certificates.
Why it's wrong here
Configuring the App Service to require client certificates enables mutual authentication, where the client presents a digital certificate to verify its identity to the server. This is a security measure for access control and identity verification, not for enforcing the use of the HTTPS protocol itself. While it secures the connection, it does not automatically redirect unencrypted HTTP requests to their HTTPS counterparts; it would simply reject connections that do not provide a valid client certificate, regardless of the protocol.
- ✓
Enable the 'HTTPS Only' setting in the App Service's TLS/SSL settings blade.
Why this is correct
Enabling the 'HTTPS Only' setting in the App Service's TLS/SSL settings blade is the recommended and most efficient method for enforcing HTTPS. This platform-level configuration automatically redirects all incoming HTTP requests to their HTTPS equivalents before they even reach the application code. This ensures that all traffic is encrypted, simplifies application development by removing the need for in-app redirection logic, and provides a robust, managed solution directly from the Azure infrastructure.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.