AZ-700 Question 302
Single answerYour organization has an Azure Application Gateway configured with the Web Application Firewall (WAF) in Detection mode to monitor suspicious activity. After a two-week observation period, you switch the WAF to Prevention mode to block malicious traffic. Despite this change, attacks still appear in the logs without being blocked. What is the most appropriate next step to ensure suspicious traffic is actively blocked?
- A
Associate the WAF policy configured in Prevention mode with the relevant Application Gateway HTTP listener to enforce blocking.
- B
Enable Azure Monitor diagnostic settings for the Application Gateway to block activities recorded in logs.
- C
Create a new WAF policy in Detection mode and add it to the Application Gateway for more granular reporting.
- D
Add a custom rule that explicitly allows the identified malicious IP addresses, to confirm any potential false positives.
Show answer and explanation
Correct answer: A
Explanation
When you switch the Web Application Firewall to Prevention mode, you must also verify that the policy is properly associated with the Application Gateway HTTP listener or the frontend configuration. Prevention mode inspects and actively blocks requests, but only if the WAF policy is correctly linked. For more details, refer to Microsoft� documentation on configuring the WAF on Application Gateway (https://learn.microsoft.com/azure/web-application-firewall/ag/web-application-firewall-ag-overview).
- A. Correct.
Correct: Even if you switch the WAF policy to Prevention mode, it must be associated with the right HTTP listener or application gateway frontend configuration. If it� not linked to the target listener, malicious traffic continues without being blocked.
- B. Incorrect.
Incorrect: Diagnostic settings only forward logs and metrics for monitoring; they do not automatically block or prevent traffic. Logs can inform you about suspicious activity, but they are not an enforcement mechanism.
- C. Incorrect.
Incorrect: Using a new policy in Detection mode does not resolve the issue of blocking malicious traffic. Detection mode only logs and alerts on suspicious requests, it does not actively drop them.
- D. Incorrect.
Incorrect: Allowing a known malicious IP address is counterproductive and defeats the purpose of the WAF. Custom rules should instead block or challenge suspicious sources, not allow them.