Clients must enter at Azure Front Door while the origin (internal App Service, Storage static website, or ILB) must not be on the public Internet. What should the security engineer implement?
Select an answer to reveal the explanation.
Short Explanation
Keep the origin dark to the Internet: Front Door Premium plus Private Link. A secret header on a public origin is a skinny lock on a glass door.
Full Explanation
Clients that must enter at Azure Front Door while the origin (internal App Service, Storage static website, or ILB) stays off the public Internet need Azure Front Door Premium with Private Link to the origin. That pattern terminates users at the global edge and keeps the canal origin private rather than publishing it for the world to scrape.
Opening the origin to the Internet and relying only on a secret header fails by concept: a shared header on a public origin is a weak allow-list, not true private-origin architecture. Using Front Door Standard without Private Link and publishing the origin with a public IP fails by concept: that model expects a publicly reachable origin for that scenario and violates the private-origin requirement. Replacing Front Door with Azure Bastion shareable links fails by concept: Bastion links are for administrative VM access, not anonymous global web clients.
Exam caveat: private origin with Front Door ⇒ Premium + Private Link; secret headers are not equivalent. Operational check: enable Front Door Premium Private Link to the origin, confirm the origin has no public Internet exposure, test global clients via Front Door only, and verify direct Internet calls to the origin fail.