AZ-700 Question 308
Select 3You are responsible for securing an online retail application running behind an Azure Application Gateway in WAF mode. Your security team has identified a set of known malicious IP addresses that repeatedly attempt to infiltrate the site, and you also need to restrict large payload attacks. Which three actions should you take when creating your Azure WAF policy to meet these requirements?
- A
Enable Prevention mode in the WAF policy.
- B
Configure a custom rule to block requests from known malicious IP addresses.
- C
Set a maximum request body size in the WAF policy.
- D
Disable all managed rule sets to reduce strict enforcement.
Show answer and explanation
Correct answers: A, B, C
Explanation
When implementing a WAF policy in Azure, best practices include enabling Prevention mode to actively block malicious traffic, leveraging custom rules to address specific threats (e.g., malicious IP ranges), and configuring request body inspection limits to mitigate large payload attacks. Disabling managed rule sets is not recommended because these rule sets help protect against a wide variety of known threats. For more information, refer to Microsoft� documentation on Azure Web Application Firewall at https://docs.microsoft.com/azure/web-application-firewall/azure-waf-overview.
- A. Correct.
Option 1: Enable Prevention mode in the WAF policy. (Correct) - Prevention mode actively blocks violations, ensuring malicious traffic is immediately rejected. Detection mode only logs suspicious activity, so using Prevention mode is essential for actually blocking threats.
- B. Correct.
Option 2: Configure a custom rule to block requests from known malicious IP addresses. (Correct) - Custom rules allow for specific threat mitigation scenarios, such as blocking a known malicious IP range. This is a direct way to handle repeated malicious attacks.
- C. Correct.
Option 3: Set a maximum request body size in the WAF policy. (Correct) - Large payload attacks can overwhelm an application. Restricting the body size helps mitigate such threats. Enabling request body inspection and setting an appropriate maximum body size are best practices.
- D. Incorrect.
Option 4: Disable all managed rule sets to reduce strict enforcement. (Incorrect) - Managed rule sets provide a broad layer of protection against common attacks (like SQL injection and cross-site scripting). Disabling them would make applications more vulnerable, defeating the purpose of using a WAF.