A botanical garden’s public storefront Container App must be reachable on HTTPS from the Internet, while the pricing engine behind it must accept calls only from other apps in the same environment. How should ingress be configured?
Select an answer to reveal the explanation.
Short Explanation
Think of the storefront as the garden’s front gate and the pricing engine as a workshop only staff can walk into. External ingress opens the gate to HTTPS callers; internal ingress keeps the workshop on the private environment path. You do not need a WAF redesign just to draw that line.
Full Explanation
Azure Container Apps ingress can be external (Internet-facing HTTP/HTTPS or TCP) or internal (reachable only inside the environment via service discovery). The public storefront should use external ingress; the pricing engine should use internal ingress so peer apps call it privately. Application Gateway or WAF may sit in front later, but the core AZ-204 control here is the Container Apps ingress mode on each app.