Custom domains and SSL in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does Azure App Service handle SSL for custom domains?

You have added a custom domain to your Azure App Service. You want to secure it with SSL. What happens when you enable App Service Managed Certificate?

A Azure automatically provisions a free SSL certificate for the custom domain and renews it without manual intervention.

B You must upload your own SSL certificate; Azure does not provide any free certificates for custom domains.

C Azure provides a free SSL certificate but only for the default azurewebsites.net domain, not for custom domains.

D Azure requires you to purchase an SSL certificate from the Azure Marketplace before enabling SSL on custom domains.

💡 Hint

Think about how Azure simplifies SSL management for custom domains in App Service.

Azure App Service Managed Certificate automatically provisions and renews free SSL certificates for custom domains, making it easy to secure your app without manual certificate management.

❓ Configuration

intermediate

Which DNS record is required to map a custom domain to an Azure Web App?

You want to point your custom domain www.example.com to your Azure Web App. Which DNS record type should you create?

A Create an MX record pointing <code>www.example.com</code> to <code>yourapp.azurewebsites.net</code>.

B Create an A record pointing <code>www.example.com</code> to the IP address of your local machine.

C Create a TXT record with the value <code>yourapp.azurewebsites.net</code>.

D Create a CNAME record pointing <code>www.example.com</code> to <code>yourapp.azurewebsites.net</code>.

💡 Hint

Think about how domain names are linked to hostnames in DNS.

A CNAME record maps a domain name to another domain name, which is the correct way to point a custom domain to an Azure Web App's default domain.

❓ Architecture

advanced

Designing SSL for multiple custom domains on Azure Front Door

You have an Azure Front Door setup with multiple backend services. You want to serve three custom domains with SSL using Front Door. Which approach ensures all domains have valid SSL certificates managed by Azure?

A Use a wildcard SSL certificate purchased externally and upload it to Azure Front Door for all domains.

B Upload individual SSL certificates for each custom domain to Azure Front Door manually.

C Use Azure Front Door's built-in TLS/SSL certificate management to enable HTTPS for all custom domains without uploading certificates.

D Disable HTTPS on Azure Front Door and handle SSL termination on each backend service.

💡 Hint

Consider Azure Front Door's capabilities for SSL certificate management.

Azure Front Door can automatically manage SSL certificates for multiple custom domains, simplifying SSL management and ensuring secure HTTPS connections.

❓ security

advanced

What is the security risk of not enabling HTTPS on a custom domain in Azure App Service?

You have configured a custom domain for your Azure App Service but did not enable HTTPS. What is the main security risk?

A Azure will disable your custom domain until HTTPS is enabled.

B Data transmitted between users and your app can be intercepted or modified by attackers (man-in-the-middle attack).

C Your app will automatically block all HTTP traffic, causing service disruption.

D There is no security risk because Azure encrypts all traffic internally.

💡 Hint

Think about what HTTPS protects against in web communication.

Without HTTPS, data sent between users and your app is not encrypted, making it vulnerable to interception and tampering by attackers.

✅ Best Practice

expert

Optimizing SSL certificate renewal for multiple Azure App Services with custom domains

You manage 10 Azure App Services each with different custom domains. You want to automate SSL certificate renewal with minimal manual effort and cost. Which approach is best?

A Use Azure App Service Managed Certificates for each custom domain to get free automatic renewal without manual intervention.

B Purchase SSL certificates from a third-party provider and manually upload them to each App Service before expiration.

C Use a single wildcard SSL certificate covering all domains and upload it to each App Service manually.

D Disable SSL on all App Services and rely on HTTP only to avoid renewal complexity.

💡 Hint

Consider Azure's native features for SSL management and automation.

Azure App Service Managed Certificates provide free SSL certificates for custom domains with automatic renewal, reducing manual work and cost for multiple apps.

Practice

1. What is the main purpose of adding a custom domain to an Azure web app?

easy

A. To increase the storage capacity of the web app

B. To use your own website name instead of Azure's default URL

C. To enable automatic backups of the web app

D. To improve the speed of the web app

Solution

1. Step 1: Understand what a custom domain is

   A custom domain lets you replace the default Azure URL with your own website name, making it easier for visitors to remember.

2. Step 2: Identify the purpose of using a custom domain

   Using your own domain improves branding and trust, not storage or speed.

3. Final Answer:

   To use your own website name instead of Azure's default URL -> Option B

4. Quick Check:

   Custom domain = Your own website name [OK]

Hint: Custom domain means your own website name, not Azure's URL [OK]

Common Mistakes:

• Confusing custom domain with storage or speed features
• Thinking custom domain automatically improves backups
• Assuming custom domain changes app performance

2. Which Azure CLI command is used to bind an SSL certificate to a web app's custom domain?

easy

A. az webapp domain bind

B. az webapp create ssl

C. az ssl certificate add

D. az webapp config ssl bind

Solution

1. Step 1: Recall Azure CLI commands for SSL binding

   The correct command to bind an SSL certificate to a web app is az webapp config ssl bind.

2. Step 2: Eliminate incorrect commands

   az webapp create ssl and az ssl certificate add are not valid commands. az webapp domain bind binds domains but not SSL certificates.

3. Final Answer:

   az webapp config ssl bind -> Option D

4. Quick Check:

   SSL bind command = az webapp config ssl bind [OK]

Hint: SSL bind uses 'az webapp config ssl bind' command [OK]

Common Mistakes:

• Using 'az webapp domain bind' for SSL binding
• Confusing create and bind commands
• Trying non-existent commands like 'az ssl certificate add'

3. Given this Azure CLI command:
az webapp config ssl bind --certificate-thumbprint abc123 --name myapp --resource-group mygroup --ssl-type SNI
What will this command do?

medium

A. Bind the SSL certificate with thumbprint abc123 to the web app myapp using SNI SSL

B. Create a new SSL certificate with thumbprint abc123 for the web app myapp

C. Remove the SSL certificate from the web app myapp

D. List all SSL certificates for the web app myapp

Solution

1. Step 1: Analyze the command parameters

   The command uses az webapp config ssl bind with a certificate thumbprint, web app name, resource group, and SSL type SNI.

2. Step 2: Understand the command effect

   This command binds the existing SSL certificate identified by thumbprint abc123 to the web app myapp using Server Name Indication (SNI) SSL.

3. Final Answer:

   Bind the SSL certificate with thumbprint abc123 to the web app myapp using SNI SSL -> Option A

4. Quick Check:

   SSL bind command with thumbprint = Bind SSL cert [OK]

Hint: Binding SSL uses thumbprint and 'az webapp config ssl bind' [OK]

Common Mistakes:

• Thinking the command creates or removes certificates
• Confusing listing certificates with binding
• Misunderstanding SNI SSL as removal

4. You tried to bind an SSL certificate to your Azure web app but got an error saying the certificate thumbprint was not found. What is the most likely cause?

medium

A. The SSL type SNI is not supported

B. The web app name is incorrect

C. The SSL certificate was not uploaded to the Azure resource group

D. The custom domain is not verified

Solution

1. Step 1: Understand the error about missing certificate thumbprint

   The error means Azure cannot find the SSL certificate with the given thumbprint in the resource group.

2. Step 2: Identify the cause

   This usually happens if the certificate was not uploaded or imported into the Azure resource group before binding.

3. Final Answer:

   The SSL certificate was not uploaded to the Azure resource group -> Option C

4. Quick Check:

   Missing thumbprint error = Certificate not uploaded [OK]

Hint: Upload SSL cert before binding to avoid thumbprint errors [OK]

Common Mistakes:

• Assuming web app name causes thumbprint errors
• Thinking SNI SSL is unsupported
• Ignoring domain verification as cause

5. You want to secure your Azure web app with a custom domain and SSL. Which sequence of steps is correct?

hard

A. Add custom domain to web app, upload SSL certificate, then bind SSL certificate to domain

B. Bind SSL certificate to web app, then add custom domain, then upload SSL certificate

C. Upload SSL certificate, add custom domain, then bind SSL certificate to domain

D. Add custom domain, bind SSL certificate, then upload SSL certificate

Solution

1. Step 1: Add the custom domain to the Azure web app

   You must first add your custom domain to the web app so Azure knows which domain to secure.

2. Step 2: Upload the SSL certificate to Azure

   Next, upload the SSL certificate to the Azure resource group to make it available for binding.

3. Step 3: Bind the SSL certificate to the custom domain

   Finally, bind the uploaded SSL certificate to the custom domain on the web app to enable HTTPS.

4. Final Answer:

   Add custom domain to web app, upload SSL certificate, then bind SSL certificate to domain -> Option A

5. Quick Check:

   Domain add -> cert upload -> cert bind [OK]

Hint: Add domain first, upload cert second, bind cert last [OK]

Common Mistakes:

• Trying to bind SSL before uploading certificate
• Binding SSL before adding custom domain
• Uploading certificate after binding