AZ-700 Question 305
Single answerYou manage a web application behind an Azure Application Gateway with Web Application Firewall (WAF) enabled, using the OWASP 3.2 rule set in Prevention mode. Recently, some valid requests from a proprietary mobile app have been rejected due to a specific cross-site scripting (XSS) rule triggered by the app's user agent string. You need to continue blocking malicious requests but allow these legitimate app requests. Which configuration should you implement to meet this requirement?
- A
Switch the WAF to Detection mode so it does not block any requests.
- B
Disable the entire OWASP 3.2 rule set for the WAF policy.
- C
Configure a rule exclusion for the cross-site scripting rule targeting only the proprietary app� user agent.
- D
Create a custom allow rule for all user agents to bypass WAF inspections.
Show answer and explanation
Correct answer: C
Explanation
When valid traffic is being incorrectly flagged by the WAF, it is best practice to use a rule exclusion (sometimes called an exception) rather than disabling the entire rule set or turning off the WAF. Azure Application Gateway WAF supports configuring exclusions based on specific match criteria (e.g., user agent strings). Refer to official Microsoft documentation on creating WAF policy exemptions (https://learn.microsoft.com/azure/web-application-firewall/ag/custom-waf-rules-overview) for detailed steps and best practices.
- A. Incorrect.
Incorrect. Detection mode only logs attacks without blocking them. This would allow malicious traffic, violating security requirements.
- B. Incorrect.
Incorrect. Disabling the entire OWASP 3.2 rule set would remove all WAF protections, leaving the application vulnerable.
- C. Correct.
Correct. Configuring a rule exclusion specific to the cross-site scripting rule and the affected user agent ensures that legitimate traffic is allowed while malicious traffic remains blocked.
- D. Incorrect.
Incorrect. Allowing all user agents bypasses WAF inspections, exposing the application to a wide range of threats.