AZ-700 Question 295
Select 2You have deployed an Azure Application Gateway with WAF (v2 SKU) to protect a mission-critical e-commerce application. The WAF uses the default OWASP rule set to block SQL injection attempts. After going live, you discover that some legitimate customer requests with encoded search parameters are being blocked. The security team wants to continue blocking SQL injection but allow valid requests without entirely switching WAF to Detection mode. Which two actions should you take to fulfill these requirements?
- A
Switch the WAF policy from Prevention to Detection mode to monitor traffic without blocking it.
- B
Configure a WAF exclusion for the specific query string parameter that is causing false positives.
- C
Allocate more compute resources to the Application Gateway to eliminate false positives completely.
- D
Select an older OWASP rule set version to relax SQL injection inspection on encoded parameters.
- E
Add a custom WAF rule that specifically blocks known SQL injection signatures but allows valid traffic.
Show answer and explanation
Correct answers: B, E
Explanation
By configuring a WAF exclusion for the affected query string parameter (option 2) and adding custom rules (option 5), you can balance security and functionality. Exclusions let you disregard certain parameters in the OWASP rule set that are mistakenly flagged, while custom rules offer targeted blocking for confirmed malicious patterns. For more information, refer to Microsoft� documentation on Azure Web Application Firewall with Application Gateway (https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-configuration).
- A. Incorrect.
Option 1 is incorrect because switching the WAF policy to Detection mode would stop it from blocking all malicious requests, contradicting the requirement to continue blocking SQL injection attempts.
- B. Correct.
Option 2 is correct. WAF exclusions can be configured to ignore specific parameters or request attributes that trigger false positives. In this scenario, excluding the problematic parameter helps permit legitimate requests while preserving overall injection protection.
- C. Incorrect.
Option 3 is incorrect. Increasing resources (for example, scaling up the Application Gateway) does not address misclassification of requests. It can improve performance but does not eliminate false positives caused by rule sets.
- D. Incorrect.
Option 4 is incorrect. Rolling back to an older rule set can weaken overall security and does not specifically solve the direct cause of false positives for encoded parameters. Microsoft recommends upgrading to newer rule sets rather than reverting to older ones.
- E. Correct.
Option 5 is correct. A custom WAF rule targeting known SQL injection patterns can block malicious traffic while allowing valid parameters that do not match these patterns. This approach provides finer control than the default rule set alone.