AZ-800 Application Gateway and WAF 2 — Questions and Answers
Question 1: A company wants to enable WAF on their Application Gateway. After enabling WAF in Detection mode, they notice malicious requests are still reaching the backend. What should they do to block these requests?
- Switch WAF to Prevention mode (Correct answer)
- Add a Network Security Group to the subnet
- Enable DDoS Standard on the VNet
- Configure a custom health probe
Correct answer: Switch WAF to Prevention mode
Detection mode only logs alerts without blocking; switching to Prevention mode causes WAF to actively block requests that match rules.
Question 2: Which OWASP Core Rule Set (CRS) version is the default managed ruleset used by Azure Application Gateway WAF_v2?
- CRS 2.2.9
- CRS 3.1
- CRS 3.2 (Correct answer)
- CRS 4.0
Correct answer: CRS 3.2
Azure Application Gateway WAF_v2 defaults to OWASP CRS 3.2, which provides updated protections compared to older versions.
Question 3: A WAF policy is configured with a custom rule that uses a rate-limit action. Where is this WAF policy attached to take effect on Application Gateway?
- To the Application Gateway subnet
- To a listener or the entire Application Gateway (Correct answer)
- To each individual backend pool
- To the VNet gateway resource
Correct answer: To a listener or the entire Application Gateway
WAF policies can be attached at the global (gateway) level or per-listener level on Application Gateway v2 SKU.
Question 4: A security team wants to exclude the 'X-Custom-Auth' request header from WAF inspection to prevent false positives. Which WAF feature supports this?
- WAF Exclusion Lists (Correct answer)
- Custom Rules with Allow action
- WAF Detection mode per route
- Backend settings overrides
Correct answer: WAF Exclusion Lists
WAF Exclusion Lists allow you to skip inspection of specific request attributes (headers, cookies, query strings) to reduce false positives.
Question 5: What is the maximum number of custom rules you can define in a single Azure WAF policy attached to an Application Gateway?
- 25
- 50
- 100 (Correct answer)
- 500
Correct answer: 100
A single WAF policy supports up to 100 custom rules for Application Gateway.
Question 6: An administrator notices that a legitimate bot crawler is being blocked by the Azure Application Gateway WAF bot protection ruleset. Which configuration should be used to allow this specific bot?
- Add the bot IP range to a WAF custom rule with Allow action and higher priority (Correct answer)
- Disable the bot protection managed ruleset entirely
- Switch WAF to Detection mode only for that listener
- Add the bot user-agent to the backend HTTP settings
Correct answer: Add the bot IP range to a WAF custom rule with Allow action and higher priority
A custom Allow rule with higher priority (lower number) than the bot protection rules will permit the specific bot traffic through.
Question 7: A WAF custom rule needs to match requests where the URI path starts with '/admin' AND the source IP is not in the corporate range 10.0.0.0/8. Which match condition operator handles the CIDR-based IP check?
- Contains
- IPMatch (Correct answer)
- GeoMatch
- Regex
Correct answer: IPMatch
The IPMatch operator in WAF custom rules evaluates whether the source IP falls within specified CIDR ranges.
AZ-800 Application Gateway and WAF 2
A company wants to enable WAF on their Application Gateway.
After enabling WAF in Detection mode, they notice malicious requests are still reaching the backend.
What should they do to block these requests?