AZ-700 exam dumps: questions 301 to 310 of 310

Correct answer: B

• A. Incorrect.

  Option A is incorrect because Azure WAF does not allow you to partially apply Detection mode to default rules and simultaneously apply Prevention mode to custom rules within the same policy. The mode (Detection or Prevention) applies to the entire policy, not individual rule sets.

• B. Correct.

  Option B is correct. In real-world scenarios, you can set the WAF policy to Detection mode to log potential threats without blocking. Then, if the logs confirm malicious behavior, you can switch the policy to Prevention mode, blocking unwanted traffic without requiring a full redeployment or complicated changes.

• C. Incorrect.

  Option C is incorrect because deploying the WAF in Prevention mode from the start may block legitimate requests if the default rules flag benign traffic. Also, removing all default rules undermines a key security layer. This approach does not align with a phased and controlled rollout.

• D. Incorrect.

  Option D is incorrect because maintaining multiple WAF policies and swapping them frequently is more complex, requiring potential downtime or reconfiguration each time. It's less efficient than adjusting the mode within a single WAF policy.

Correct answer: A

• A. Correct.

  Correct: Even if you switch the WAF policy to Prevention mode, it must be associated with the right HTTP listener or application gateway frontend configuration. If it� not linked to the target listener, malicious traffic continues without being blocked.

• B. Incorrect.

  Incorrect: Diagnostic settings only forward logs and metrics for monitoring; they do not automatically block or prevent traffic. Logs can inform you about suspicious activity, but they are not an enforcement mechanism.

• C. Incorrect.

  Incorrect: Using a new policy in Detection mode does not resolve the issue of blocking malicious traffic. Detection mode only logs and alerts on suspicious requests, it does not actively drop them.

• D. Incorrect.

  Incorrect: Allowing a known malicious IP address is counterproductive and defeats the purpose of the WAF. Custom rules should instead block or challenge suspicious sources, not allow them.

Correct answer: A

• A. Correct.

  Correct. In Azure Front Door WAF, a custom rule with a lower numeric priority (which is treated as higher precedence) than the default rule set will allow matching traffic to pass before the default rules are evaluated. This ensures that traffic from the specified IP range is allowed.

• B. Incorrect.

  Incorrect. You cannot modify the in-built OWASP managed rule sets directly. While you can enable, disable, or configure exclusions for certain request attributes, you can't remove an IP range from all signatures globally. It's more practical and recommended to create a custom rule with appropriate priority.

• C. Incorrect.

  Incorrect. Setting the Action to Redirect will send the requests to a different location but does not provide a direct Allow override. Additionally, malicious requests from that IP range might still be processed incorrectly, depending on the rule logic. Allow is more appropriate here.

• D. Incorrect.

  Incorrect. Disabling the OWASP rule set removes a critical layer of protection. The recommended approach is to keep the validated and tested managed rule sets for well-known vulnerabilities while customizing only the exceptions as needed.

Correct answers: B, D

• A. Incorrect.

  Option 1: Incorrect. Enabling the older Microsoft_DefaultRuleSet 1.1 without creating a separate custom rule for malicious IP addresses does not adequately address the specific block requirement. Exclusions in managed rule sets are typically meant for excluding parameters or requests from detection checks, not for explicitly blocking IPs.

• B. Correct.

  Option 2: Correct. Custom rules allow precise matching against IP addresses. Creating a rule that targets the malicious IP addresses and setting the action to Block ensures those addresses are denied access. This is the recommended approach for explicit blocking scenarios.

• C. Incorrect.

  Option 3: Incorrect. Editing the existing managed rule set to allow all traffic before evaluating other rules would effectively negate the WAF's protection. You typically do not add a global 'Allow all' rule to the managed set; instead, you must create a custom rule for the new requirement and use rule priorities properly.

• D. Correct.

  Option 4: Correct. By creating a custom rule that explicitly allows traffic from trusted partner IP addresses and assigning it a higher priority (in WAF terms, a lower numerical value), those requests are allowed before the malicious-block rule is evaluated.

Correct answer: C

• A. Incorrect.

  Incorrect. Detection mode only logs attacks without blocking them. This would allow malicious traffic, violating security requirements.

• B. Incorrect.

  Incorrect. Disabling the entire OWASP 3.2 rule set would remove all WAF protections, leaving the application vulnerable.

• C. Correct.

  Correct. Configuring a rule exclusion specific to the cross-site scripting rule and the affected user agent ensures that legitimate traffic is allowed while malicious traffic remains blocked.

• D. Incorrect.

  Incorrect. Allowing all user agents bypasses WAF inspections, exposing the application to a wide range of threats.