AZ-700 Question 298
Select 2Your organization hosts an internal line-of-business application behind an Azure Web Application Firewall (WAF) on Azure Application Gateway. You need to prevent SQL injection attacks and also allow specific internal IP ranges to bypass WAF inspection. Which two capabilities of Azure WAF should you use to meet these requirements?
- A
Rate-limiting rules
- B
The OWASP Core Rule Set (CRS)
- C
Custom WAF rules
- D
Azure DDoS Protection
Show answer and explanation
Correct answers: B, C
Explanation
To meet both the prevention of SQL injection attacks and the selective bypass for trusted IP ranges, you must enable the OWASP Core Rule Set for well-known attack protections and create custom WAF rules to allow specific internal IP ranges to skip WAF processing. Refer to Microsoft� official documentation on Azure Web Application Firewall (https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview) for more details on configuring managed rule sets and custom rules.
- A. Incorrect.
Rate-limiting rules help manage high volumes of traffic, but they do not specifically detect or block SQL injection attacks, nor do they allow you to selectively bypass WAF inspection for certain IP ranges. This option alone does not satisfy the given requirements.
- B. Correct.
The OWASP Core Rule Set (CRS) is a default ruleset included with Azure WAF that provides protection against common web exploits, including SQL injection and cross-site scripting. Enabling this ruleset helps you meet the requirement to prevent SQL injection attacks.
- C. Correct.
Custom WAF rules allow you to specify match conditions (e.g., IP addresses, headers, or request URIs) and take actions such as blocking, allowing, or logging traffic. By creating a custom rule to allow traffic from specific internal IP ranges, you can bypass WAF inspection for those addresses, meeting the second requirement.
- D. Incorrect.
Azure DDoS Protection is designed to mitigate Distributed Denial-of-Service attacks at the network level and is not intended for blocking SQL injection attempts or selectively bypassing inspection. It does not address the stated requirements.