AZ-800 - Microsoft Azure Networking Solutions Application Gateway and WAF Questions and Answers

Question 1

An administrator is configuring an Azure Application Gateway to host two different websites, `contoso.com` and `fabrikam.com`, on a single public IP address. Requests for `contoso.com` should be sent to one backend pool, and requests for `fabrikam.com` should be sent to another. Which Application Gateway listener type and routing rule combination is required to achieve this?

Accepted Answer

A Multi-site listener with a basic routing rule.

Answer

A Multi-site listener is designed to route requests to different backend pools based on the hostname in the request header. This allows a single Application Gateway to serve multiple websites. A basic routing rule is then sufficient to connect this listener to the appropriate backend pool for each site. Path-based routing is used for routing based on the URL path, not the hostname.

Question 2

A company is deploying a new web application behind an Azure Application Gateway with a Web Application Firewall (WAF) v2 policy. To minimize the risk of blocking legitimate traffic, the security team wants to monitor and log potential attacks without actively blocking them during the initial rollout. Which WAF mode should be configured?

Accepted Answer

Detection

Answer

Detection mode is specifically designed for this purpose. When the WAF is in Detection mode, it monitors and logs all threat alerts without blocking incoming requests. This allows administrators to analyze WAF logs and identify potential false positives before switching to Prevention mode, which actively blocks detected threats.

Question 3

You are troubleshooting an unhealthy backend pool status for an Azure Application Gateway. The backend servers are virtual machines running a web service. The health probe is configured to use HTTPS, but the backend health report shows 'Unhealthy'. Which of the following is the MOST likely cause of this issue?

Accepted Answer

The root certificate of the backend server's SSL certificate is not uploaded to the Application Gateway's HTTP settings.

Answer

For end-to-end TLS encryption, which is used when an HTTPS health probe is configured, the Application Gateway must trust the backend server's SSL certificate. If the backend certificate is signed by a private Certificate Authority (CA) or is self-signed, the root certificate of that CA must be uploaded to the Application Gateway's Backend HTTP settings as a trusted root certificate for the health probe to succeed.

Question 4

An administrator needs to configure an Application Gateway to handle SSL/TLS encryption and decryption for incoming client connections, while the traffic between the Application Gateway and the backend web servers remains unencrypted. This configuration is intended to offload the CPU-intensive encryption work from the backend servers. What is this configuration called?

Accepted Answer

SSL/TLS termination

Answer

This scenario describes SSL/TLS termination. The Application Gateway decrypts incoming TLS traffic from clients, inspects it, and then forwards the unencrypted traffic to the backend servers. This process offloads the encryption/decryption overhead from the web servers. End-to-end TLS involves re-encrypting the traffic before sending it to the backend.

Question 5

Which of the following is a primary benefit of using a Web Application Firewall (WAF) policy on an Azure Application Gateway?

Accepted Answer

It protects web applications from common exploits and vulnerabilities like SQL injection and cross-site scripting.

Answer

The primary function of a Web Application Firewall (WAF) on an Application Gateway is to provide centralized protection for web applications against common exploits and vulnerabilities. It is based on rules from the OWASP (Open Web Application Security Project) Core Rule Sets to protect against attacks like SQL injection, cross-site scripting, and more.

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 - Microsoft Azure Networking Solutions Application Gateway and WAF Questions and Answers