The water-lab portal must use Layer-7 routing but must not have a public IP. What Application Gateway frontend design should the security engineer deploy?
Select an answer to reveal the explanation.
Short Explanation
Want L7 routing without a public IP? Give Application Gateway a private frontend in the VNet and reach it over VPN or ExpressRoute. External ASE is a different product.
Full Explanation
The water-lab portal that needs Layer-7 routing without a public IP should use Application Gateway with a private frontend IP configuration in the VNet (internal only). Clients then reach the gateway through VPN, ExpressRoute, or related private-access patterns already used in Domain 2 networking—preserving L7 features without a public VIP.
Deploying Application Gateway with only a public frontend IP and relying on hostname obscurity fails by concept: a public frontend contradicts the no-public-IP requirement, and obscurity is not a control. Replacing Application Gateway with an External ASE fails by concept: External ASE is a different product and still uses a public inbound VIP; it is not a private Application Gateway frontend. Attaching a public IP and disabling WAF fails by concept: that both violates the private frontend goal and removes application-layer protection.
Exam caveat: Application Gateway supports private frontend IPs—do not confuse that with Internal ASE or with “disable WAF to look internal.” Operational check: create Application Gateway with private frontend only, remove public frontend IPs, verify resolution/reachability over VPN/ExpressRoute, and confirm L7 listeners/routes still serve the water-lab portal.