Clients must enter at Azure Front Door while the origin (internal App Service, Storage static website, or ILB) must not be on the public Internet. What should the security engineer implement?
Select an answer to reveal the explanation.
Short Explanation
Keep the origin dark to the Internet: Front Door Premium plus Private Link. A secret header on a public origin is a skinny lock on a glass door.
Full Explanation
Azure Front Door Premium supports Private Link to origins so clients terminate at the global edge while the origin remains private. Opening the origin and relying only on a secret header is a weaker pattern and not the best private-origin design. Front Door Standard without Private Link typically implies a publicly reachable origin model for that scenario. Bastion shareable links are for administrative VM access, not anonymous global web entry.