Browsers reach Application Gateway over HTTPS, but the gateway opens HTTP to backend VMs on the VNet. Auditors require encryption all the way to the backends. What should the security engineer configure?
Select an answer to reveal the explanation.
Short Explanation
Listener cert only protects the browser hop. Turn on HTTPS in the backend HTTP settings too, or the VNet leg is still cleartext.
Full Explanation
End-to-end TLS on Application Gateway requires both a TLS/HTTPS listener toward clients and HTTPS backend HTTP settings toward the VMs. A listener certificate alone leaves gateway-to-backend traffic in cleartext if backends use HTTP. App Service minimum TLS is a different resource’s control and does not encrypt Application Gateway backend connections. Disabling the HTTPS listener weakens the public entry point.