AZ-700 Question 297
Select 3You are designing a solution for an e-commerce platform behind Azure Application Gateway with Web Application Firewall (WAF) enabled. The platform processes sensitive customer data and is frequently targeted by SQL injection and cross-site scripting (XSS) attacks. Additionally, you want to block requests from known malicious IP addresses while allowing certain partner IP ranges, ensuring minimal disruption to legitimate traffic. Which three WAF capabilities or configurations should you implement to meet these requirements?
- A
Enable the OWASP Core Rule Set (CRS) within Azure WAF
- B
Create custom WAF rules to block suspicious or known malicious IP addresses
- C
Add custom WAF rules to allow traffic from specific partner IP ranges
- D
Enable DDoS Standard protection directly from the Azure WAF settings
- E
Use WAF to automatically scale your backend virtual machines based on traffic
Show answer and explanation
Correct answers: A, B, C
Explanation
Azure WAF (whether on Application Gateway or Azure Front Door) can use managed rule sets (like the OWASP CRS) to protect against common threats. Additionally, it supports custom rules to allow or block specific IP addresses, giving you fine-grained control over traffic filtering. DDoS Standard protection is configured at the network level, not within the WAF settings, and scaling of backend resources is managed through Azure scale sets or App Service scaling. For more details, consult Microsoft� official documentation on configuring Azure WAF and custom WAF rules.
- A. Correct.
Correct. The OWASP Core Rule Set helps protect against common web exploits, including SQL injection and cross-site scripting.
- B. Correct.
Correct. Creating custom IP-based block rules allows you to reject known malicious IP addresses or IP ranges, strengthening security.
- C. Correct.
Correct. You can add custom rules to explicitly allow traffic from partner IP addresses, ensuring those requests are not blocked.
- D. Incorrect.
Incorrect. DDoS Standard protection is not configured directly within WAF. You must configure Azure DDoS Protection Standard as a separate service at the virtual network level.
- E. Incorrect.
Incorrect. WAF does not handle scaling decisions for backend VMs. Auto-scaling in Azure is configured through virtual machine scale sets or App Service scale settings, not the WAF.