AZ-500 Secure networking Practice Question
Your company uses Azure Front Door to globally distribute traffic to a web app. You need to ensure that only traffic from Front Door can reach the web app, and all other traffic is blocked. The web app is behind an Azure Application Gateway. What is the most secure and reliable configuration?
⚠ Common exam trap
A common mix-up: candidates confuse the Front Door frontend IP (used by clients to reach Front Door) with the backend IP ranges (used by Front Door to reach the origin), leading them to choose Option D, which is incorrect because the Application Gateway receives traffic from Front Door's backend IPs, not its frontend IPs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an NSG on the Application Gateway subnet to allow traffic only from the Front Door backend IP ranges.
Azure Front Door uses a set of backend IP ranges that are documented and change over time. By configuring an NSG on the Application Gateway subnet to allow traffic only from these specific IP ranges, you ensure that only Front Door-originated traffic reaches the Application Gateway, while all other traffic is blocked. This approach is reliable because it uses network-layer filtering that the Application Gateway subnet enforces, and it avoids the complexity of private endpoints or service tags that may not apply to the Front Door-to-Application Gateway path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place the web app behind a private endpoint and connect Front Door via private link.
Why it's wrong here
Private endpoint not applicable to Application Gateway.
- ✗
Use an NSG on the Application Gateway subnet with a deny-all rule and allow the AzureFrontDoor.Backend service tag.
Why it's wrong here
The service tag is for Front Door's backend, not frontend.
- ✓
Configure an NSG on the Application Gateway subnet to allow traffic only from the Front Door backend IP ranges.
Why this is correct
Front Door publishes backend IP ranges that can be used in NSGs.
- ✗
Restrict the Application Gateway to only accept traffic from the Front Door frontend IP.
Why it's wrong here
Front Door frontend IP is anycast and not static.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.