Cascade Regional Airlines' internal reservations API only needs to be reachable from clients inside its own VNet, and the platform team wants Layer 7 path-based routing and a WAF applied to that internal traffic without exposing anything to the public internet. Which service fits this requirement?
Select an answer to reveal the explanation.
Short Explanation
You don't need a global front door for traffic that never leaves the building. An Application Gateway with a private frontend, deployed right inside the VNet, gives internal clients the same path-based routing and WAF protection without ever touching the public internet.
Full Explanation
Application Gateway can be deployed with an internal (private) frontend IP configuration inside a VNet's subnet, which keeps Layer 7 features like path-based routing, WAF, and SSL termination available to clients within the VNet or connected networks while never exposing an endpoint to the public internet. Azure Front Door is a global, edge-based service that anycasts across Microsoft's edge points of presence and is designed for internet-facing, cross-region traffic; it isn't deployed inside a customer VNet and doesn't fit a strictly internal requirement. Traffic Manager is a DNS-based global routing layer with no data-plane inspection at all — it can't apply a WAF or path-based rules because it never sees the actual HTTP traffic, only resolves DNS queries. A public Standard Load Balancer operates at Layer 4 and has no concept of URL paths, HTTP headers, or a WAF; it can only distribute TCP/UDP flows based on IP and port. The exam-relevant caveat: an internal Application Gateway still needs its own dedicated subnet within the VNet, and that subnet cannot be shared with other resource types. To verify the deployment, check that the gateway's frontend IP configuration is set to Private (not Public) and that clients testing from outside the VNet cannot reach it while clients inside can.