AZ-500 Secure networking Practice Question
A company has multiple on-premises web applications that need to be securely published for remote employees. The company uses Azure AD for identity management and wants to apply Conditional Access policies, including multi-factor authentication, to these applications. The security team wants to avoid exposing the on-premises infrastructure to the internet directly. Which Azure service should they deploy to meet these requirements?
⚠ Common exam trap
Candidates often confuse Azure AD Application Proxy with Azure Application Gateway or Azure Front Door, assuming any reverse proxy can secure on-premises apps, but only Application Proxy uses an outbound-only connector that keeps the internal network completely hidden from the internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure AD Application Proxy
Azure AD Application Proxy is the correct service because it provides secure remote access to on-premises web applications without requiring a VPN or opening inbound firewall ports. It integrates natively with Azure AD, enabling Conditional Access policies such as multi-factor authentication (MFA) to be applied to these applications. The service works by establishing an outbound-only connection from the on-premises Application Proxy connector to Azure AD, ensuring the on-premises infrastructure is never directly exposed to the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Application Gateway
Why it's wrong here
Application Gateway is a web traffic load balancer that can expose on-premises apps only if they are reachable from Azure, typically via a VPN or ExpressRoute, and it requires custom configuration for Azure AD authentication.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is a global load balancer and CDN that accelerates and routes HTTP/S traffic at the edge, but it cannot natively reach on-premises applications unless those backends are publicly exposed or reachable through a separate private-link or VNet injection. It lacks the Azure AD pre-authentication and outbound-connector model needed to hide on-premises apps from the internet, and it does not provide the same Kerberos constrained delegation integration for seamless SSO. Thus, while it can distribute traffic to Azure-hosted endpoints, it is not a secure publishing solution for on-premises web apps.
- ✓
Azure AD Application Proxy
Why this is correct
Azure AD Application Proxy is the correct choice because it publishes on-premises web applications externally without opening inbound firewall ports: a lightweight connector runs inside the on-premises network and makes outbound connections to Azure AD, so the app never needs a public inbound path. It performs Azure AD pre-authentication at the cloud layer before any request reaches the on-premises application, enabling integration with Conditional Access policies and MFA. It also supports single sign-on to web apps via Kerberos constrained delegation, making it the purpose-built service for securely exposing on-premises apps to remote users.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway establishes an encrypted IPsec tunnel between on-premises networks and Azure, providing site-to-site (or point-to-site) network-level connectivity, but it does not inspect or proxy HTTP/S requests at the application layer. It does not perform Azure AD pre-authentication, support SSO protocols for web apps, or enforce Conditional Access policies, and it would leave on-premises apps needing a separate reverse proxy or Application Gateway front end to handle authentication. Therefore, a VPN gateway alone cannot securely publish web applications to external users; it only grants network access to resources in the virtual network.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.