AZ-800 - Microsoft Azure Networking Solutions Application Gateway and WAF Questions and Answers — Questions and Answers
Question 1: An administrator is configuring an Azure Application Gateway to host two different websites, `contoso.com` and `fabrikam.com`, on a single public IP address. Requests for `contoso.com` should be sent to one backend pool, and requests for `fabrikam.com` should be sent to another. Which Application Gateway listener type and routing rule combination is required to achieve this?
- A Basic listener with a path-based routing rule.
- A Multi-site listener with a basic routing rule. (Correct answer)
- A Basic listener with a basic routing rule.
- A Multi-site listener with a path-based routing rule.
Correct answer: A Multi-site listener with a basic routing rule.
A Multi-site listener is designed to route requests to different backend pools based on the hostname in the request header. This allows a single Application Gateway to serve multiple websites. A basic routing rule is then sufficient to connect this listener to the appropriate backend pool for each site. Path-based routing is used for routing based on the URL path, not the hostname.
Question 2: A company is deploying a new web application behind an Azure Application Gateway with a Web Application Firewall (WAF) v2 policy. To minimize the risk of blocking legitimate traffic, the security team wants to monitor and log potential attacks without actively blocking them during the initial rollout. Which WAF mode should be configured?
- Prevention
- Disabled
- Detection (Correct answer)
- Auditing
Correct answer: Detection
Detection mode is specifically designed for this purpose. When the WAF is in Detection mode, it monitors and logs all threat alerts without blocking incoming requests. This allows administrators to analyze WAF logs and identify potential false positives before switching to Prevention mode, which actively blocks detected threats.
Question 3: You are troubleshooting an unhealthy backend pool status for an Azure Application Gateway. The backend servers are virtual machines running a web service. The health probe is configured to use HTTPS, but the backend health report shows 'Unhealthy'. Which of the following is the MOST likely cause of this issue?
- The Network Security Group (NSG) on the Application Gateway subnet is blocking outbound traffic on port 443.
- The backend server's firewall is blocking traffic from the 'Internet' service tag.
- The default health probe is attempting to connect to 127.0.0.1 on the backend server.
- The root certificate of the backend server's SSL certificate is not uploaded to the Application Gateway's HTTP settings. (Correct answer)
Correct answer: The root certificate of the backend server's SSL certificate is not uploaded to the Application Gateway's HTTP settings.
For end-to-end TLS encryption, which is used when an HTTPS health probe is configured, the Application Gateway must trust the backend server's SSL certificate. If the backend certificate is signed by a private Certificate Authority (CA) or is self-signed, the root certificate of that CA must be uploaded to the Application Gateway's Backend HTTP settings as a trusted root certificate for the health probe to succeed.
Question 4: An administrator needs to configure an Application Gateway to handle SSL/TLS encryption and decryption for incoming client connections, while the traffic between the Application Gateway and the backend web servers remains unencrypted. This configuration is intended to offload the CPU-intensive encryption work from the backend servers. What is this configuration called?
- End-to-end TLS encryption
- TLS passthrough
- SSL/TLS termination (Correct answer)
- WAF inspection
Correct answer: SSL/TLS termination
This scenario describes SSL/TLS termination. The Application Gateway decrypts incoming TLS traffic from clients, inspects it, and then forwards the unencrypted traffic to the backend servers. This process offloads the encryption/decryption overhead from the web servers. End-to-end TLS involves re-encrypting the traffic before sending it to the backend.
Question 5: Which of the following is a primary benefit of using a Web Application Firewall (WAF) policy on an Azure Application Gateway?
- It provides layer 4 load balancing based on source and destination IP addresses.
- It protects web applications from common exploits and vulnerabilities like SQL injection and cross-site scripting. (Correct answer)
- It enables automatic scaling of backend instances based on CPU utilization.
- It allows for URL path-based routing to different backend pools.
Correct answer: It protects web applications from common exploits and vulnerabilities like SQL injection and cross-site scripting.
The primary function of a Web Application Firewall (WAF) on an Application Gateway is to provide centralized protection for web applications against common exploits and vulnerabilities. It is based on rules from the OWASP (Open Web Application Security Project) Core Rule Sets to protect against attacks like SQL injection, cross-site scripting, and more.
Question 6: An application hosted behind an Application Gateway needs to route traffic for `/api/*` to a set of backend servers optimized for API calls, and traffic for `/images/*` to a different set of servers optimized for serving static content. All other requests should go to a default pool of web servers. Which Application Gateway feature should be configured?
- Multi-site listeners
- URL path-based routing (Correct answer)
- SSL/TLS termination
- Custom health probes
Correct answer: URL path-based routing
URL path-based routing is the feature designed for this scenario. It allows you to create rules that route traffic to different backend server pools based on the URL path in the client's request. You can define specific paths (like `/api/*` and `/images/*`) and map them to their corresponding backend pools, with a default pool for any requests that don't match the specified paths.
AZ-800 - Microsoft Azure Networking Solutions Application Gateway and WAF Questions and Answers
An administrator is configuring an Azure Application Gateway to host two different websites, `contoso.com` and `fabrikam.com`, on a single public IP address.
Requests for `contoso.com` should be sent to one backend pool, and requests for `fabrikam.com` should be sent to another.
Which Application Gateway listener type and routing rule combination is required to achieve this?