AZ-500 Manage identity and access Practice Question
A company has an on-premises web application that they want to expose to external users over the internet without requiring a VPN. External users must authenticate with Modern Authentication (e.g., using Azure Multi-Factor Authentication) and access policies must be enforced via Conditional Access. The application does not support SAML or OAuth. Which Azure service should they use to publish this application securely?
⚠ Common exam trap
Many exam-takers confuse Azure AD Application Proxy with Azure Application Gateway, assuming that WAF provides authentication, but Application Gateway does not integrate with Azure AD for Modern Authentication or Conditional Access enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure AD Application Proxy.
Azure AD Application Proxy is the correct choice because it allows publishing on-premises web applications to external users without requiring a VPN, supports Modern Authentication (including Azure MFA), and enforces Conditional Access policies. It works by installing a connector on-premises that proxies traffic through Azure AD, enabling authentication and policy enforcement even for legacy applications that do not support SAML or OAuth.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure AD B2C (Business-to-Consumer).
Why it's wrong here
Azure AD B2C is a platform for managing external customer identities, native to social or local account sign-up/sign-in, and returns identity tokens to a relying application. It is not a reverse proxy or publishing gateway, so it cannot relay traffic from the public internet into a private on-premises network; B2C only validates who the user is, and the application itself must remain directly reachable over HTTPS. For a public-facing web app, B2C provides authentication but lacks the outbound-connector model and pre-authenticated session relay that would allow a non-public on-premises app to be exposed without a VPN or inbound firewall rule.
- ✗
Azure Application Gateway with Web Application Firewall (WAF).
Why it's wrong here
Application Gateway is a Layer 7 load balancer that can handle public web traffic, but it does not provide Azure AD pre-authentication or the ability to connect to on-premises apps without a VPN. It requires the backend to be accessible.
- ✓
Azure AD Application Proxy.
Why this is correct
Azure AD Application Proxy is the appropriate service here because it is purpose-built to publish on-premises HTTP/HTTPS apps to external users through Azure AD. A lightweight connector installed on the corporate network establishes an outbound connection to the Azure AD Application Proxy service, eliminating the need for inbound firewall ports or a VPN; the external endpoint is an Azure AD URL that performs full Azure AD pre-authentication, including MFA and Conditional Access, before passing the authenticated request back through the connector to the internal web application. It effectively acts as an HTTPS reverse proxy bridged by an outbound-only tunnel, which is exactly what is required to securely expose an on-premises web app without making it publicly reachable.
- ✗
Azure Front Door.
Why it's wrong here
Azure Front Door is a global load balancer and CDN for web applications. It does not integrate with Azure AD pre-authentication by default and requires the backend to be publicly accessible or connected via private link, not suitable for on-premises apps without a VPN.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.