A public botanical-garden site runs on an External App Service Environment. What inbound-security conclusion should the security engineer draw?
Select an answer to reveal the explanation.
Short Explanation
External ASE still wears a public VIP. Living in a VNet doesn’t mean “already isolated”—park NSG, Firewall, or WAF in front like any other public edge.
Full Explanation
External ASE places a public inbound VIP on the environment; VNet injection alone does not equal Internet isolation. Security engineers still layer NSG, Azure Firewall, and/or WAF as appropriate. Assuming External ASE is private confuses it with Internal (ILB) ASE. Bastion is for administrative RDP/SSH paths, not public HTTP(S) visitor traffic. Disabling TLS to ease inspection weakens the public site and is not the WAF pattern.