AZ-700 Question 300
Single answerYou need to design a Web Application Firewall (WAF) deployment for an organization that hosts multiple web applications behind Azure Application Gateway. Each application requires different rule sets and security policies due to varying compliance and vulnerability profiles. The organization wants to maintain strong security while minimizing maintenance overhead. Which design approach should you implement?
- A
Configure a single WAF policy at the global level for all applications under a single Application Gateway listener
- B
Configure multiple WAF policies, assigning each policy to individual listeners in an Application Gateway WAF v2
- C
Use a Network Security Group (NSG) instead of WAF to handle both Layer 7 security and application-specific rules
- D
Deploy an Azure Firewall and rely on built-in Layer 7 capabilities to meet all WAF requirements
Show answer and explanation
Correct answer: B
Explanation
When designing a WAF deployment with multiple web applications that have distinct security requirements, leveraging Azure Application Gateway WAF v2 with per-listener WAF policies is recommended. This approach enables each application to have its own custom rule sets while centralizing management on the same gateway. Refer to the official Azure documentation (https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview) for detailed guidance on configuring custom WAF policies.
- A. Incorrect.
Option 1 is incorrect because applying a single WAF policy at the global level makes it difficult to customize rules for each application. This approach limits granular tuning and often increases the risk of false positives or missed coverage for app-specific threats.
- B. Correct.
Option 2 is correct. With Azure Application Gateway WAF v2, you can associate multiple custom WAF policies, each tailored to the specific needs of an individual listener or route. This provides the flexibility required for different rule sets and security requirements, while centralizing overall management on the same gateway.
- C. Incorrect.
Option 3 is incorrect because a Network Security Group (NSG) operates at Layers 3 and 4 (network and transport layers). NSGs do not provide Layer 7 protection or OWASP rule sets that a WAF does.
- D. Incorrect.
Option 4 is incorrect because Azure Firewall primarily focuses on network-level filtering and does not replace a WAF� application-layer protection. While it can complement WAF, it does not provide richer Layer 7 security features such as OWASP rule sets or granular per-application policies.