Which Azure Services Secure App1 and Connect It to DB1 VMs?
Short answer
Use Azure Application Gateway WAF to protect App1, Azure Bastion for secure admin access to VM1 and VM2, and regional virtual network integration so App1 reaches DB1 without internet.
Question
You plan to deploy an Azure App Service web app named App1 that will service users in a single geographical region. App1 will access a highly available database named DB1 that will be hosted on two Azure virtual machines named VM1 and VM2.
You need to recommend a solution that meets the following requirements:
• Uses Azure Web Application Firewall (WAF) to minimize the risk of a web-based attack against App1
• Ensures that administrators can access VM1 and VM2 securely from the internet
• Ensures that traffic from App1 to DB1 is NOT sent via the internet
• Minimizes costs
What should you include in the recommendation for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Key Takeaways
Tested: mapping each requirement to the minimal-cost Azure networking service; the trap is choosing Azure Front Door for single-region WAF or relying on public IPs for VM admin access instead of Bastion.
This AZ-305 hotspot scenario requires selecting Azure services to protect an App Service web app with WAF, provide secure admin access to VMs, and connect to a database without public internet. The correct combination is Application Gateway WAF_v2, Azure Bastion, and regional virtual network integration.
Common mistake: A common mistake is selecting Azure Front Door Premium for WAF because it includes WAF, but Front Door is a global service and more expensive than Application Gateway when App1 serves a single region. Another is using public IPs with NSG rules for VM admin access instead of Azure Bastion, which exposes RDP/SSH to the internet.
Expert Analysis
Why the Answer Is Correct
Application Gateway with WAF_v2 is the correct choice for minimizing web-based attacks against App1 because it is a regional Layer 7 load balancer that provides Azure WAF protection, and it is more cost-effective than Azure Front Door when App1 serves a single geographical region. Azure Bastion meets the secure administrative access requirement by providing RDP/SSH connectivity over TLS directly from the Azure portal without exposing public IP addresses on VM1 and VM2. Regional virtual network integration for the App Service web app allows outbound traffic from App1 to reach the private IP addresses of DB1 on VM1 and VM2 over the Azure backbone, so database traffic never traverses the internet. Together, these services satisfy all four requirements while minimizing cost. As gpais noted, the correct selections are "Azure Application Gateway", "Azure Bastion", and "Virtual network integration".
Why Other Candidate Answers Are Wrong
Azure Front Door is a common distractor for the WAF requirement, but it is a global service designed for multi-region HTTP load balancing and its WAF-enabled SKUs are more expensive than a regional Application Gateway for a single-region App1. Azure Firewall could inspect traffic, but it is not a WAF for web applications; it would not satisfy the requirement to minimize web-based attacks against App1's HTTP/S endpoint. Using public IP addresses on VM1 and VM2 with network security group rules for administrative access exposes RDP/SSH to the internet and fails the secure access requirement, whereas Bastion provides private connectivity without public IPs. For App1-to-DB1 traffic, relying on public endpoints or a VPN gateway without VNet integration does not prevent traffic from leaving the Azure network; App Service requires virtual network integration to route outbound calls privately. An App Service Environment would also work for isolation but is significantly more costly than VNet integration.
Community Comment Notes
gpais shared a correct breakdown of the hotspot selections: Application Gateway for WAF, Azure Bastion for administrative access, and virtual network integration for App1-to-DB1 connectivity. The comment reinforces that DB1 on two VMs inside a virtual network is reached through private IP space, so App1 needs outbound VNet integration rather than a public database endpoint. No other comments challenge this mapping, so the community consensus aligns with the official Azure architecture guidance that Application Gateway, Bastion, and VNet integration are the minimal-cost services for these requirements. The key takeaway from the discussion is to match each requirement to a purpose-built Azure service rather than over-provisioning with global or high-cost alternatives.
Official Reference
- https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview
- https://learn.microsoft.com/en-us/azure/bastion/bastion-overview
- https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration
These links open the official vendor documentation in a new tab.
Exam Strategy
For AZ-305 hotspot questions, read each requirement independently and choose the least-cost Azure service that fully satisfies it. When the scenario specifies a single region, avoid global services like Front Door unless global distribution is required. For secure VM administration from the internet, Azure Bastion is the default answer over public IPs or jump boxes.
Frequently Asked Questions
Why not use Azure Front Door WAF for App1 in a single region?
Can App1 reach DB1 on VMs without VNet integration?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
gpais 👍 1The correct selections for the hotspot areas are: • Minimize the risk of a web-based attack against App1: Azure Application Gateway • Provide administrative access to VM1 and VM2: Azure Bastion • Provide App1 with access to DB1: Virtual network integration DB1 is hosted on two Azure Virtual Machines inside a VNet. App1 is an Azure App Service web app that needs to make outbound calls to that database without routing over the public internet. Virtual network integration (specifically Regional VNet Integration) creates a secure outbound pipeline from the App Service directly into the virtual network, allowing it to communicate with the private IP addresses of VM1 and VM2 safely over the Microsoft backbone.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →