You must provide App1 with a private endpoint and ensure internet requests to App1 are routed through Front Door instance FD1. What configuration should you add to FD1 to enable this behavior?

The correct answer is an origin that enables the Azure Private Link service. To route internet requests through Front Door to a private endpoint, you must configure an origin in Front Door that points to the private endpoint. When creating this origin, you enable the Azure Private Link service, which allows Front Door to securely connect to the private endpoint over the Azure backbone network. This ensures that traffic from Front Door to App1 remains private and does not traverse the public internet. A security policy that redirects traffic is incorrect because security policies are primarily for WAF rules and access control, not for defining origin connections to private endpoints. A rule that has the route configuration override action is incorrect because while rules can modify routing behavior, the fundamental connection to a private endpoint is established through the origin configuration itself, not an override action. A route that redirects traffic is incorrect because routes define how requests are matched and forwarded, but the secure private connection to the backend service is established at the origin level through Private Link integration.