SC-100 Certification Practice Question #206

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance.
You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance.
Solution: You recommend access restrictions that allow traffic from the Front Door service tags.
Does this meet the goal?

Accepted Answer

MS Learn is explicit that a service-tag access-restriction rule only limits traffic to the Azure Front Door service as a whole; to guarantee traffic originates from *your specific* Front Door instance you must additionally filter on the X-Azure-FDID HTTP header. Because the scenario asks to allow access only through *the* Front Door instance, service tags alone are insufficient and the solution does not fully meet the goal — answer No (B). Confidence is held at 80 because the community is genuinely split: the top "A" comment (12 👍) is nearly as upvoted as the top "B" comment (11 👍) and reads the goal more loosely, but the official Suggested Answer, the dominant 28-vote tally, and the literal MS Learn wording ("further filter ... based on the unique HTTP header") favor B.

More SC-100 practice questions