Browsers reach Application Gateway over HTTPS, but the gateway opens HTTP to backend VMs on the VNet. Auditors require encryption all the way to the backends. What should the security engineer configure?
Select an answer to reveal the explanation.
Short Explanation
Listener cert only protects the browser hop. Turn on HTTPS in the backend HTTP settings too, or the VNet leg is still cleartext.
Full Explanation
Auditors who require encryption all the way to backend VMs are asking for end-to-end TLS on Application Gateway: a TLS/HTTPS listener toward browsers and HTTPS backend HTTP settings toward the VMs on the VNet. Listener certificates alone protect only the client-to-gateway hop; the gateway-to-backend leg stays cleartext if backends remain on HTTP for the waterway portal.
Keeping HTTP to the backends and relying only on the listener certificate fails by concept: that is TLS offload, not end-to-end encryption to the virtual machines. Lowering App Service minimum TLS on an unrelated web app fails by concept: a different resource’s TLS floor does not encrypt Application Gateway backend connections. Disabling the HTTPS listener so backends can use cleartext fails by concept: it weakens the public entry point and abandons the auditor requirement.
Exam caveat: “end-to-end TLS” on Application Gateway means both listener and backend HTTPS settings—not listener-only offload. Operational check: configure HTTPS backend settings with trusted backend certificates (or the documented trust model), confirm packet capture or gateway diagnostics show TLS to the VMs, and retest browser HTTPS to the waterway portal.