A company runs six web apps in one resource group in East US, all hosted on the same App Service plan. They need one TLS certificate that every app can bind to, without uploading the certificate separately to each app. Where should the certificate be stored?
Show answer and explanation
Answer: A
A certificate uploaded to a resource group is shared by the web apps in that resource group when the certificate and the apps are in the same region. Uploading once and binding from many apps avoids repeated uploads and keeps renewal in one place. Certificates are not scoped to an App Service plan, so the plan-level approach describes a scope that does not exist. Front Door is a separate edge service and does not install certificates into individual App Service apps.
Why the other options are wrong
- B. App Service plans host compute and scale settings. Certificates are not uploaded to a plan and cannot be bound from one, so this option describes a resource scope that does not exist.
- C. Per-app uploads with scripts work but multiply the upload and renewal work the scenario wants to avoid. The requirement explicitly rules out uploading to each app individually.
- D. Azure Front Door can terminate TLS at the edge, but it does not install certificates into App Service apps. Routing all traffic through it adds a service the scenario did not ask for.
Exam tip. App Service certificates are scoped to a resource group and region, not to an App Service plan.