Contoso hosts an internal line-of-business application on an Azure App Service (App Service plan, not a Function App). Security requires that the app be reachable only from within the corporate virtual network and never over the public internet. You decide to create a private endpoint for the App Service. When creating the private endpoint in the Azure portal, which target sub-resource must you select so that inbound traffic to the web app is routed privately?