A global SaaS provider, BlueSun, has an internal web app on 10.1.2.10:443 in the hub VNet and wants to publish it to the internet using a single public IP on Azure Firewall DNAT. They require the external endpoint to be https://app.bluesun.com and want the firewall to terminate TLS for IDPS inspection, then re-encrypt to the backend using the existing internal certificate. Which DNAT and firewall configuration accomplishes this?

The correct option addresses all requirements: a DNAT rule translates the public IP to the internal web app. Enabling TLS inspection on Azure Firewall with a certificate for app.bluesun.com allows the firewall to decrypt, inspect, and re-encrypt traffic. The requirement to "re-encrypt to the backend using the existing internal certificate" means the backend server must present a valid certificate (in this case, for app.bluesun.com) for the firewall to establish a new, secure connection. The first incorrect option, "downstream TLS passthrough," would prevent the firewall from re-encrypting to the backend using the existing internal certificate, as it implies passing the original encrypted traffic. The third and fourth options introduce additional components (Application Gateway WAF or Load Balancer) which are unnecessary given the explicit request to use Azure Firewall for publishing and TLS termination.