An Azure virtual machine scale set (VMSS1) is behind a Standard Load Balancer (LB1). A web app deployed to VMSS1 requires HTTPS and mutual TLS client certificates. You must recommend a minimal-administration health check solution that also identifies whether individual VMSS1 instances are eligible for upgrade operations. What should you include in your recommendation?

The Application Health extension is the correct choice because it allows for in-guest health checks, directly assessing the application's readiness and ability to serve traffic, including the complex requirements of HTTPS and mutual TLS. This granular health status is crucial for upgrade operations, ensuring instances are healthy before being considered for updates. An Azure Load Balancer health probe only checks the health of the backend pool, not the application itself, and cannot provide the detailed in-guest health needed for upgrade eligibility. Azure Monitor autoscale is for scaling decisions, not for detailed application health checks for upgrades. The Custom Script Extension can run scripts but doesn't provide a continuous, integrated health monitoring solution like the Application Health extension.