AZ-500 Question 110
Select 2You have configured Azure Front Door with a Web Application Firewall (WAF) in Prevention mode to protect your web application from malicious traffic. However, your WAF is now blocking requests from a known partner's IP range due to a specific signature match in the managed rule set. You want to allow valid requests from this partner while continuing to block malicious traffic from other addresses. Which two actions should you take?
- A
Switch WAF to Detection mode so it no longer blocks your partner’s requests
- B
Create a custom rule to allow traffic from the known partner IP range
- C
Disable the entire managed rule set for the partner’s traffic path to avoid false positives
- D
Configure an exclusion rule to skip the offending signature match for the partner's IP range
Show answer and explanation
Correct answers: B, D
Explanation
To address false positives caused by WAF rules and still maintain security posture, create a custom rule or configure exclusions specific to trusted IP ranges. Azure Front Door WAF allows you to use custom rules (allow, block, or match actions) and manage exclusions to handle known safe traffic without disabling the entire WAF or switching to Detection mode. By doing so, you continue to protect your application from malicious requests while allowing legitimate partner traffic. For more details, refer to Microsoft’s documentation on creating and configuring WAF custom rules and exclusions for Azure Front Door.
- A. Incorrect.
Option 1: Switch WAF to Detection mode so it no longer blocks your partner’s requests. (Incorrect), While switching to Detection mode will prevent any traffic from being blocked (including your partner’s traffic), it also stops blocking actual malicious requests. This does not align with the goal of continuing to block malicious traffic.
- B. Correct.
Option 2: Create a custom rule to allow traffic from the known partner IP range. (Correct), One recommended approach is creating a custom rule that specifically allows traffic from the partner’s known IP range. This way, traffic from other IPs remains subject to the managed rule set checks, and you maintain strong security for non-partner traffic.
- C. Incorrect.
Option 3: Disable the entire managed rule set for the partner’s traffic path to avoid false positives. (Incorrect), Disabling the managed rule set entirely is too broad and removes all of the protection provided by WAF. This goes beyond what is necessary to handle false positives for a legitimate partner’s traffic.
- D. Correct.
Option 4: Configure an exclusion rule to skip the offending signature match for the partner's IP range. (Correct), Azure Front Door WAF supports exclusion lists and, in certain scenarios, you can configure exclusions to skip rules or signatures for trusted sources. This is a balanced approach that addresses the false positives for your partner’s traffic and still applies the managed rule set to all other requests.