AZ-900 Describe Azure architecture and services Practice Question
A company needs to make their web application available with a custom domain name and SSL certificate. Which Azure service provides this capability for App Service?
⚠ Common exam trap
Many candidates confuse Azure Front Door or Azure CDN as the service that adds custom domains and SSL to App Service, but those services are optional traffic optimizers—the core capability is always within App Service itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure App Service custom domain and SSL binding
Azure App Service natively supports binding a custom domain to your web app and uploading or configuring an SSL/TLS certificate for HTTPS. This is done through the 'Custom domains' and 'TLS/SSL settings' blades in the portal, which directly associate the domain and certificate with the App Service resource, enabling secure access over HTTPS without additional services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure DNS with Azure CDN
Why it's wrong here
Azure DNS handles domain name resolution, and Azure CDN can serve content with custom domains and SSL, but this combination is not the native or simplest way to secure a custom domain for an App Service app. You would still need to configure the domain in App Service, and CDN adds an extra caching layer that is unnecessary for this scenario. The built-in App Service custom domain and SSL binding is directly integrated, making this option an overengineered alternative.
- ✓
Azure App Service custom domain and SSL binding
Why this is correct
Azure App Service natively supports adding a custom domain to your web app and binding an SSL certificate to that domain for HTTPS, all from the same service. You can upload your own certificate or use an App Service Managed Certificate, and the binding is configured through the portal or CLI without needing extra services. This built-in capability is the most straightforward and directly integrated method for securing a custom domain in this scenario.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is a global load balancer and CDN service that does support custom domains and SSL termination, but it is designed for advanced routing, global acceleration, and WAF scenarios. Using Front Door solely to add a custom domain with SSL to a simple App Service app would introduce unnecessary complexity, cost, and an extra network hop. App Service already provides an integrated, single-service capability for custom domain and SSL binding, which is the appropriate and simpler solution.
- ✗
Azure Key Vault only
Why it's wrong here
Azure Key Vault is a cloud service for securely storing and accessing secrets, including SSL/TLS certificates, but it does not provide custom domain binding or HTTPS endpoint enforcement for App Service. To use a custom domain with SSL, you must also configure the domain in App Service and import or bind the certificate from Key Vault. Key Vault alone cannot make your app accessible via your own domain, so this option is incomplete.
Go deeper
Related to this question
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.