A lock-booking web app in one region needs path-based routing, a private backend pool of VMs, and a single public HTTPS listener. Which service should the security engineer choose?
Select an answer to reveal the explanation.
Short Explanation
One region, path-based routes, private VM pool, public HTTPS listener—that’s Application Gateway. Firewall isn’t an L7 reverse proxy, and Front Door is the global anycast story.
Full Explanation
When canal web front ends need regional path-based routing, HTTPS listeners, and backend pools that can target private VMs, Azure Application Gateway is the correct regional Layer-7 reverse proxy. It terminates or proxies HTTP(S) in-region with path maps and backend pools—the right tool before considering global anycast edges.
Azure Firewall fails by concept for this requirement: it is not an HTTP reverse proxy for application path routing even though it excels at egress, DNAT, FQDN, and threat intelligence. Azure Front Door fails by concept when the stated need is regional L7 reverse proxying: Front Door is the global anycast L7/CDN entry point and is the next skill when multi-region edge is required. Azure Bastion fails by concept: Bastion provides administrative RDP/SSH to VMs, not public or partner application hosting with path-based routing.
Exam caveat: Application Gateway = regional L7; Front Door = global L7/CDN—do not interchange them on AZ-500 public-access items. Operational check: deploy Application Gateway with HTTPS listener and path-based rules to private VM backends, verify routing per path, and confirm Firewall/Bastion are not being misused as the HTTP application entry.