The public lock-status App Service still answers HTTP and accepts TLS 1.0. What should the security engineer configure on App Service?
Select an answer to reveal the explanation.
Short Explanation
Flip HTTPS Only and raise min TLS to 1.2 on the app itself. You can’t NSG the multi-tenant front end into compliance, and Key Vault rotation won’t fix a weak listener.
Full Explanation
App Service TLS controls for public sites include enabling HTTPS Only and setting a minimum TLS version (1.2 or the current documented floor). Those settings are configured on the App Service resource. NSGs do not attach to the multi-tenant App Service front end as a substitute. APIM inbound policy XML addresses gateway policies (and is out of scope as an AZ-204-style dump here). Key Vault rotation is Domain 4 certificate lifecycle work, not App Service TLS enforcement.