AZ-500 Secure networking Practice Question
You need to restrict access to a web app hosted on Azure App Service so that only traffic from a specific virtual network (VNet) is allowed. Which Azure service should you configure?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Firewall or Application Gateway as the required service for VNet-only access, but the native App Service access restrictions feature is the simplest and most direct way to achieve this without additional cost or complexity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
App Service access restrictions
App Service access restrictions allow you to define an allow/deny list of IP addresses or virtual network (VNet) sources directly at the App Service level. By configuring a VNet integration and a service endpoint or private endpoint, you can restrict inbound traffic to only originate from a specific VNet, without needing an additional network appliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway provides Layer-7 load balancing, SSL termination, and a Web Application Firewall, but it does not natively enforce access restrictions on an App Service. Access rules for a web app are configured directly on the App Service resource, not on an upstream gateway. Even if you place an Application Gateway in front, you would still need App Service access restrictions to block direct requests to the app's public endpoint, making this an incomplete and incorrect answer.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is a global, multi-tenant CDN and routing service that accelerates and secures applications at the edge, but it is not the App Service's own access-control feature. While Front Door can apply WAF and geo-filtering rules, those are enforced at the edge, not at the App Service's network stack, so they do not restrict access to the underlying app directly. The feature you need is the App Service access restrictions setting, not Front Door.
- ✓
App Service access restrictions
Why this is correct
App Service access restrictions are the built-in, platform-level feature that lets you control inbound traffic to your web app by allowing or denying accesses from specific IP addresses, IP CIDR ranges, or virtual network service endpoints. These rules are evaluated at the front-end of the App Service, blocking unauthorized requests before they reach your code. By combining a default 'deny' rule with explicit 'allow' rules, you can precisely limit access to selected sources, making this the correct feature for the requirement.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a managed cloud firewall that filters traffic between Azure virtual networks and subnets, but it is not a feature of App Service itself. Using it would require complex routing through a hub virtual network or user-defined routes, and it still does not remove the need to enforce access restrictions at the App Service endpoint. The native mechanism for restricting access to a web app is App Service access restrictions, not Azure Firewall.
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.