AZ-204 Certification Practice Question #82

Question

You have an Azure App Service Web App named App1. App1 has /public and /private areas. The App Service plan of App1 uses the D1 pricing tier.

You plan to configure mutual TLS authentication for App1. The solution must minimize cost.

You need to ensure that only the /private area of App1 will require mutual TLS authentication.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Accepted Answer

The D1 (Shared) tier does not support client certificates at all — an upgrade to at least Basic (B1) must happen first. Once on a supported plan, the client certificate mode setting must be changed from "Ignore" to "Require" or "Optional" so the app begins requesting client certs. Finally, the certificate exclusion path setting allows /public to bypass mTLS while /private requires it. This three-step sequence is the only logical order; the only alternative actions ("Add identity provider" and "Downgrade tier") do not relate to mTLS. The sole commenter (JP_37, 👍 5) also describes exactly this sequence, and MS Learn confirms that higher tiers plus exclusion paths are the correct mechanism.

More AZ-204 practice questions