AZ-700 Question 309
Select 2You have deployed an Application Gateway in Azure using the Standard_v2 SKU to route traffic to multiple web applications. Your security team has created a custom WAF policy named 'FinancePolicy' to protect incoming HTTP/HTTPS traffic. You need to ensure that the WAF policy is inspecting requests for all (or selected) sites behind this Application Gateway. Which two actions should you perform to properly associate the policy?
- A
Switch the Application Gateway to WAF_v2 SKU and associate the 'FinancePolicy' under the Web Application Firewall configuration for global coverage.
- B
Assign the 'FinancePolicy' in Azure Policy, targeting the resource group of the Application Gateway, so the WAF policy is automatically enforced.
- C
Attach the 'FinancePolicy' to each HTTPS (or HTTP) listener by selecting the policy in the listener� WAF policy association setting.
- D
Include the 'FinancePolicy' name in a custom probe configuration for each backend pool in the Application Gateway.
- E
Enable WAF at the HTTP settings level for each backend pool and reference 'FinancePolicy' in the health probe.
Show answer and explanation
Correct answers: A, C
Explanation
To associate a WAF policy with Azure Application Gateway, you must use the WAF_v2 SKU and attach the policy either globally (covering all listeners) or per listener. Refer to Microsoft documentation (https://learn.microsoft.com/azure/web-application-firewall/ag/configure-waf-policy-ag) for detailed steps on configuring and associating WAF policies in Azure Application Gateway.
- A. Correct.
Option 1 is correct. Before you can associate a WAF policy, the Application Gateway SKU must be WAF_v2. Once upgraded or deployed with WAF_v2, you can attach your custom WAF policy (such as 'FinancePolicy') in the WAF configuration to protect all traffic at a global level.
- B. Incorrect.
Option 2 is incorrect. While Azure Policy can enforce configurations across resources, it does not specifically attach a WAF policy to an Application Gateway in this manner. You still need to associate the WAF policy directly with the Application Gateway to apply the policy rules.
- C. Correct.
Option 3 is correct. In addition to global association, you can also associate a WAF policy per listener. This helps in scenarios where you want different policies for different domains or endpoints. Selecting the listener and attaching the policy ensures the WAF rules apply to traffic on that particular listener.
- D. Incorrect.
Option 4 is incorrect. Custom probes are used to check backend health; associating a WAF policy here does not automatically intercept and inspect all incoming traffic. WAF policies need to be linked at the global or listener level.
- E. Incorrect.
Option 5 is incorrect. WAF policies are not attached at the HTTP settings level or health probes. WAF enforcement happens at the gateway or listener, not the backend pool� health probe configuration.