Task 3.4: Create and configure Azure App Service

• AEnable Always On on the app

  Incorrect

  Always On keeps the app loaded; it doesn't unlock deployment slots.

• BScale the plan out to two instances

  Incorrect

  Instance count doesn't matter; slots depend on the pricing tier.

• CTurn on the App Service backup schedule

  Incorrect

  Backups are unrelated to slots; they're supported from Basic, which the plan already is.

• DScale the plan up to Standard or higher

  Correct

  Multiple deployment slots need the Standard, Premium or Isolated tier.

Deployment slots are live apps with their own host names, available in the Standard, Premium and Isolated tiers. Each tier allows a different number of slots, so scaling down needs a tier that fits the slots you use.

• AA CNAME record for @ pointing to the app's default host name

  Incorrect

  A CNAME isn't used for a root domain; App Service tells you to use an A record there.

• BAn A record for @ pointing to the app's IP address

  Correct

  For a root domain the domain mapping is an A record to the app's inbound IP address.

• CA TXT record named asuid containing the domain verification ID

  Correct

  For the root domain, App Service checks the asuid TXT record to verify you own the domain.

• DAn MX record for @ pointing to the app's default host name

  Incorrect

  MX records route email; App Service doesn't use them for domain mapping.

• EA TXT record named @ containing the app's IP address

  Incorrect

  Verification uses the asuid record with the verification ID, not a record holding the IP address.

A root domain is mapped with an A record and verified with a TXT record named asuid that holds the app's domain verification ID. A subdomain uses a CNAME, where the asuid TXT record is strongly recommended to prevent subdomain takeover.

• AStore the connection strings in the app's web.config

  Incorrect

  Settings in the deployed files move with the content during a swap, so the strings would follow the code.

• BMark each connection string as a deployment slot setting

  Correct

  A deployment slot setting is sticky: it stays with its slot and isn't swapped with the content.

• CSwap with preview, then cancel the swap at the second phase

  Incorrect

  Canceling a swap with preview reverts the swap; it doesn't keep chosen settings in their slots during a completed swap.

• DTurn on auto swap for the staging slot

  Incorrect

  Auto swap only triggers the swap after each deployment; the connection strings would still move with the content.

By default, app settings and connection strings move with the swap. Marking one as a deployment slot setting makes it sticky to the slot, so each slot keeps its own value after the swap.

• ATurn on Always On

  Incorrect

  Always On keeps the app loaded between requests; it doesn't enable custom domains.

• BCreate a deployment slot

  Incorrect

  Slots are unavailable on Free and unrelated to domains.

• CEnable HTTPS Only

  Incorrect

  HTTPS Only redirects HTTP traffic; it doesn't enable custom domains.

• DScale the plan to a paid tier

  Correct

  Free apps can use only their azurewebsites.net name; paid tiers support custom domains.

The Free tier supports only the azurewebsites.net subdomain. Custom domains need a paid plan.

• AMove the app to the Basic tier

  Incorrect

  Basic supports backups too, but with the same 30-day automatic retention.

• BConfigure custom backups kept indefinitely

  Correct

  Custom backups can be kept up to 30 days or indefinitely, so they can be held for the 90 days auditors need.

• CScale out the plan to more instances

  Incorrect

  Instance count has no effect on how long backups are kept.

• DExtend the automatic backup retention to 90 days

  Incorrect

  Automatic backups keep 30 days, and the retention isn't configurable.

In supported tiers App Service takes automatic backups, kept for 30 days and not configurable. Custom backups, configured with a storage account, can be kept up to 30 days or indefinitely.

• AMinimum inbound TLS version 1.2

  Incorrect

  This rejects old TLS versions but doesn't redirect HTTP.

• BAlways On

  Incorrect

  Always On keeps the app loaded and has nothing to do with HTTPS.

• CHTTPS Only

  Correct

  HTTPS Only redirects HTTP requests to HTTPS.

• DClient certificate mode Require

  Incorrect

  Client certificates authenticate callers; they don't redirect HTTP.

HTTPS Only enforces HTTPS by redirecting HTTP requests. The minimum TLS setting separately restricts which TLS versions are accepted.

• AEnable Always On for the other four apps

  Incorrect

  Always On keeps apps loaded; it doesn't separate compute.

• BMove the reporting app to its own App Service plan

  Correct

  Apps in the same plan share VM instances; a separate plan isolates the app's compute.

• CTurn on HTTPS Only for the reporting app

  Incorrect

  HTTPS Only redirects HTTP; it doesn't affect CPU sharing.

• DAdd a deployment slot for the reporting app

  Incorrect

  Slots run on the same plan's instances, so they share the same compute.

All apps in an App Service plan run on the same VM instances and scale together. To isolate compute for one app, create a separate plan for it.