Question

A retail company is migrating a customer-facing web application to Azure App Service (PaaS). The security architect must define baseline requirements that reduce the workload's exposure while following Microsoft's recommended security guidance for web workloads. The application currently uses a connection string with an embedded SQL password stored in the app settings, accepts inbound traffic over both HTTP and HTTPS, and allows connections from any client IP. Which combination of baseline requirements should the architect specify to best harden this web workload?

Accepted Answer

Enforce HTTPS-only with a minimum TLS version, replace the connection string with a system-assigned managed identity to Azure SQL, and restrict inbound traffic using access restrictions and Private Endpoint

Answer

Deploy the app behind an Azure Load Balancer, enable Azure DDoS Basic protection, and store the SQL password in an app setting marked as a slot setting

Answer

Enable client certificate authentication for all users, move the app to an isolated App Service Environment, and keep the connection string but rotate the password every 30 days manually

Answer

Turn on Microsoft Defender for App Service, allow both HTTP and HTTPS for backward compatibility, and store the SQL credentials in Azure Key Vault referenced by an app setting