AZ-104 Practice Question 47: App Service Custom Domain DNS
Microsoft Azure Administrator Associate (AZ-104) · Test 5 · question 7 of 10
A web app currently answers on contoso-web.azurewebsites.net and runs on a Free (F1) App Service plan. It must answer on www.contoso.com over HTTPS, using an App Service Managed Certificate. You control the public DNS zone for contoso.com at an external registrar.
What must you do?
Show answer and explanation
Answer:
Three separate requirements land in this answer. The tier: "the web app's App Service plan must be a paid tier, not the Free (F1) tier", and the App Service Managed Certificate option is offered "if your app is in the Basic tier or higher". The records: "for each custom domain in App Service, you need two DNS records with your domain provider"; for a subdomain the recommended mapping is a CNAME record, because "you can map a subdomain to the app's IP address directly with an A record, but it's possible for the IP address to change", plus a TXT record at asuid.<subdomain>, which "App Service accesses ... to verify your ownership of the custom domain" and which guards against subdomain takeover.
Option A fails on the tier and picks the fragile record type. An A record for a subdomain pins you to an inbound IP that can change, and the Free tier cannot host a custom domain at all.
Option C uses the wrong kind of zone. "Your custom domains must be in a public DNS zone; private DNS zones aren't supported"; a private zone only resolves for linked virtual networks, not for the internet.
Option D skips domain validation. App Service will not accept a hostname it cannot verify you own, and without the mapping record no public resolver would send www.contoso.com to the app in the first place.
Reference: Map an existing custom DNS name to Azure App Service