Question

Your company runs a web application behind an Azure Application Gateway v2 (Standard_v2). During a security audit, penetration testers report that backend responses expose a 'Server' HTTP response header that reveals the underlying web server product and version. Developers cannot modify the backend application in the near term. Security requires that this header be stripped before responses reach clients, with no impact to existing listeners or routing. What should you configure on the Application Gateway?

Accepted Answer

Create a rewrite rule set that deletes the 'Server' response header by setting its header value to empty, and associate the rule set with the routing rule.

Answer

Enable a custom health probe that matches on the 'Server' header so the gateway filters it out of responses.

Answer

Modify the HTTP setting to use 'Pick host name from backend address' so the backend server identity is hidden.

Answer

Configure end-to-end TLS on the backend pool so the encrypted response prevents the 'Server' header from being read.