Which Azure Services Secure App1 and Connect It to DB1 VMs?
HOTSPOT
You plan to deploy an Azure App Service web app named App1 that will service users in a single geographical region. App1 will access a highly available database named DB1 that will be hosted on two Azure virtual machines named VM1 and VM2.
You need to recommend a solution that meets the following requirements:
• Uses Azure Web Application Firewall (WAF) to minimize the risk of a web-based attack against App1
• Ensures that administrators can access VM1 and VM2 securely from the internet
• Ensures that traffic from App1 to DB1 is NOT sent via the internet
• Minimizes costs
What should you include in the recommendation for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Community Insight
Tested: mapping each requirement to the minimal-cost Azure networking service; the trap is choosing Azure Front Door for single-region WAF or relying on public IPs for VM admin access instead of Bastion.
This AZ-305 hotspot scenario requires selecting Azure services to protect an App Service web app with WAF, provide secure admin access to VMs, and connect to a database without public internet. The correct combination is Application Gateway WAF_v2, Azure Bastion, and regional virtual network integration.
A common mistake is selecting Azure Front Door Premium for WAF because it includes WAF, but Front Door is a global service and more expensive than Application Gateway when App1 serves a single region. Another is using public IPs with NSG rules for VM admin access instead of Azure Bastion, which exposes RDP/SSH to the internet.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Application Gateway with WAF_v2 is the correct choice for minimizing web-based attacks against App1 because it is a regional Layer 7 load balancer that provides Azure WAF protection, and it is more cost-effective than Azure Front Door when App1 serves a single geographical region. Azure Bastion meets the secure administrative access requirement by providing RDP/SSH connectivity over TLS directly from the Azure portal without exposing public IP addresses on VM1 and VM2. Regional virtual network integration for the App Service web app allows outbound traffic from App1 to reach the private IP addresses of DB1 on VM1 and VM2 over the Azure backbone, so database traffic never traverses the internet. Together, these services satisfy all four requirements while minimizing cost. As gpais noted, the correct selections are "Azure Application Gateway", "Azure Bastion", and "Virtual network integration".Why Other Candidate Answers Are Wrong
Azure Front Door is a common distractor for the WAF requirement, but it is a global service designed for multi-region HTTP load balancing and its WAF-enabled SKUs are more expensive than a regional Application Gateway for a single-region App1. Azure Firewall could inspect traffic, but it is not a WAF for web applications; it would not satisfy the requirement to minimize web-based attacks against App1's HTTP/S endpoint. Using public IP addresses on VM1 and VM2 with network security group rules for administrative access exposes RDP/SSH to the internet and fails the secure access requirement, whereas Bastion provides private connectivity without public IPs. For App1-to-DB1 traffic, relying on public endpoints or a VPN gateway without VNet integration does not prevent traffic from leaving the Azure network; App Service requires virtual network integration to route outbound calls privately. An App Service Environment would also work for isolation but is significantly more costly than VNet integration.Community Comment Notes
gpais shared a correct breakdown of the hotspot selections: Application Gateway for WAF, Azure Bastion for administrative access, and virtual network integration for App1-to-DB1 connectivity. The comment reinforces that DB1 on two VMs inside a virtual network is reached through private IP space, so App1 needs outbound VNet integration rather than a public database endpoint. No other comments challenge this mapping, so the community consensus aligns with the official Azure architecture guidance that Application Gateway, Bastion, and VNet integration are the minimal-cost services for these requirements. The key takeaway from the discussion is to match each requirement to a purpose-built Azure service rather than over-provisioning with global or high-cost alternatives.Official Reference
Exam Strategy
For AZ-305 hotspot questions, read each requirement independently and choose the least-cost Azure service that fully satisfies it. When the scenario specifies a single region, avoid global services like Front Door unless global distribution is required. For secure VM administration from the internet, Azure Bastion is the default answer over public IPs or jump boxes.
Frequently Asked Questions
Why not use Azure Front Door WAF for App1 in a single region?
Azure Front Door is a global service with higher cost; for a single-region App Service app, Application Gateway WAF_v2 satisfies the WAF requirement at lower cost.
Can App1 reach DB1 on VMs without VNet integration?
No. By default App Service outbound traffic goes to the public internet. Regional virtual network integration routes outbound calls through the VNet, keeping DB1 traffic off the internet.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →