The water-lab portal must use Layer-7 routing but must not have a public IP. What Application Gateway frontend design should the security engineer deploy?
Select an answer to reveal the explanation.
Short Explanation
Want L7 routing without a public IP? Give Application Gateway a private frontend in the VNet and reach it over VPN or ExpressRoute. External ASE is a different product.
Full Explanation
Application Gateway can use a private frontend IP configuration so it is internal-only within the VNet, suitable when L7 routing is required without a public IP. Clients then reach it through VPN, ExpressRoute, or other private-access patterns already used in the networking domain. A public-only frontend contradicts the requirement. Internal/ILB ASE solves App Service Environment inbound isolation and is not a synonym for a private Application Gateway frontend.