The public lock-status App Service still answers HTTP and accepts TLS 1.0. What should the security engineer configure on App Service?
Select an answer to reveal the explanation.
Short Explanation
Flip HTTPS Only and raise min TLS to 1.2 on the app itself. You can’t NSG the multi-tenant front end into compliance, and Key Vault rotation won’t fix a weak listener.
Full Explanation
Public App Service sites that still answer HTTP and accept TLS 1.0 must be hardened on the App Service resource itself. For the lock-status site, enable HTTPS Only and set the minimum TLS version to 1.2 (or the current documented floor) so browsers are redirected to HTTPS and obsolete protocol versions are refused.
Attaching an NSG to the multi-tenant App Service front end to block HTTP fails by concept: customers do not NSG the shared multi-tenant front end as the primary TLS control; App Service TLS settings do that job. Writing an API Management inbound policy XML dump while leaving App Service TLS unchanged fails by concept: APIM policies govern the gateway, not the App Service TLS floor for this site. Creating a Key Vault rotation policy only fails by concept: certificate lifecycle is Domain 4 work and does not enable HTTPS Only or raise the App Service minimum TLS version.
Exam caveat: configure HTTPS Only and min TLS on App Service before chasing NSG, APIM XML, or Key Vault distractors. Operational check: set HTTPS Only on, set minimum TLS to 1.2+, browse the lock-status URL over HTTP and confirm redirect/refusal, and verify a TLS 1.0 client is rejected while modern clients succeed.