SC-100 Certification Practice Question #148

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance.
You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance.
Solution: You recommend access restrictions based on HTTP headers that have the Front Door ID.
Does this meet the goal?

Accepted Answer

The goal is to ensure the web apps allow access only through the specific Front Door instance. MS Learn states that an `AzureFrontDoor.Backend` service tag restricts to Front Door in general, but to lock down to *your* instance you must additionally filter on the unique `X-Azure-FDID` header, which carries your Front Door ID. The proposed solution — access restrictions based on HTTP headers that have the Front Door ID — is precisely the documented mechanism, so it meets the goal. Suggested Answer, the 36-vote community majority, and multiple doc-citing comments all agree on A. The minority "No" votes argue header-only isn't a complete defense-in-depth design, but the stated goal is narrowly about restricting to the Front Door instance, which the FDID header accomplishes.

More SC-100 practice questions