locks.canal.example must present a trusted certificate to browsers on App Service. What should the security engineer implement for TLS on the app?
Select an answer to reveal the explanation.
Short Explanation
Point the custom hostname at App Service and hang a real cert on it—managed cert or one the app references. VNet integration and an empty Key Vault don’t put TLS on the public hostname.
Full Explanation
Custom-domain TLS on App Service requires binding the hostname and a trusted certificate (App Service managed certificate or a certificate the app references, which may be sourced from Key Vault). Regional VNet integration addresses private access, not public custom-domain TLS. Code-level Kestrel TLS is an AZ-204 concern and not the App Service platform binding. Creating a Key Vault without completing the App Service custom-domain and certificate binding does not finish the TLS task.