AZ-800 - Microsoft Azure Networking Solutions Application Gateway and WAF Questions and Answers

Question 1

An administrator is configuring an Azure Application Gateway to host two different websites, `contoso.com` and `fabrikam.com`, on a single public IP address.
Requests for `contoso.com` should be sent to one backend pool, and requests for `fabrikam.com` should be sent to another.
Which Application Gateway listener type and routing rule combination is required to achieve this?

Accepted Answer

A Multi-site listener with a basic routing rule.

Answer

A Basic listener with a path-based routing rule.

Answer

A Basic listener with a basic routing rule.

Answer

A Multi-site listener with a path-based routing rule.

Question 2

A company is deploying a new web application behind an Azure Application Gateway with a Web Application Firewall (WAF) v2 policy. To minimize the risk of blocking legitimate traffic, the security team wants to monitor and log potential attacks without actively blocking them during the initial rollout. Which WAF mode should be configured?

Accepted Answer

Detection

Answer

Prevention

Answer

Disabled

Answer

Auditing

Question 3

You are troubleshooting an unhealthy backend pool status for an Azure Application Gateway. The backend servers are virtual machines running a web service. The health probe is configured to use HTTPS, but the backend health report shows 'Unhealthy'. Which of the following is the MOST likely cause of this issue?

Accepted Answer

The root certificate of the backend server's SSL certificate is not uploaded to the Application Gateway's HTTP settings.

Answer

The Network Security Group (NSG) on the Application Gateway subnet is blocking outbound traffic on port 443.

Answer

The backend server's firewall is blocking traffic from the 'Internet' service tag.

Answer

The default health probe is attempting to connect to 127.0.0.1 on the backend server.

Question 4

An administrator needs to configure an Application Gateway to handle SSL/TLS encryption and decryption for incoming client connections, while the traffic between the Application Gateway and the backend web servers remains unencrypted. This configuration is intended to offload the CPU-intensive encryption work from the backend servers. What is this configuration called?

Accepted Answer

SSL/TLS termination

Answer

End-to-end TLS encryption

Answer

TLS passthrough

Answer

WAF inspection

Question 5

Which of the following is a primary benefit of using a Web Application Firewall (WAF) policy on an Azure Application Gateway?

Accepted Answer

It protects web applications from common exploits and vulnerabilities like SQL injection and cross-site scripting.

Answer

It provides layer 4 load balancing based on source and destination IP addresses.

Answer

It enables automatic scaling of backend instances based on CPU utilization.

Answer

It allows for URL path-based routing to different backend pools.

Question 6

An application hosted behind an Application Gateway needs to route traffic for `/api/*` to a set of backend servers optimized for API calls, and traffic for `/images/*` to a different set of servers optimized for serving static content. All other requests should go to a default pool of web servers. Which Application Gateway feature should be configured?

Accepted Answer

URL path-based routing

Answer

Multi-site listeners

Answer

SSL/TLS termination

Answer

Custom health probes