Canal-operations web apps must not receive a public inbound VIP. Which App Service Environment design meets that inbound-isolation requirement?
Select an answer to reveal the explanation.
Short Explanation
Need the site off the public Internet? Pick Internal (ILB) ASE v3—the inbound address lives as a private IP in your VNet. External ASE still hangs a public VIP on the door.
Full Explanation
An Internal (ILB) App Service Environment v3 places the inbound address as a private IP inside the customer VNet, which is the correct inbound-isolation choice when public VIPs are forbidden. An External ASE exposes a public inbound VIP and is not equivalent isolation. Multi-tenant App Service with a public IP plus DDoS Protection Standard does not make the estate private. Container Apps and Defender for Cloud posture settings are different products and do not replace ILB ASE for this requirement.