AZ-800 Application Gateway and WAF 2

Question 1

A company wants to enable WAF on their Application Gateway.
After enabling WAF in Detection mode, they notice malicious requests are still reaching the backend.
What should they do to block these requests?

Accepted Answer

Switch WAF to Prevention mode

Answer

Add a Network Security Group to the subnet

Answer

Enable DDoS Standard on the VNet

Answer

Configure a custom health probe

Question 2

Which OWASP Core Rule Set (CRS) version is the default managed ruleset used by Azure Application Gateway WAF_v2?

Accepted Answer

CRS 3.2

Answer

CRS 2.2.9

Answer

CRS 3.1

Answer

CRS 4.0

Question 3

A WAF policy is configured with a custom rule that uses a rate-limit action. Where is this WAF policy attached to take effect on Application Gateway?

Accepted Answer

To a listener or the entire Application Gateway

Answer

To the Application Gateway subnet

Answer

To each individual backend pool

Answer

To the VNet gateway resource

Question 4

A security team wants to exclude the 'X-Custom-Auth' request header from WAF inspection to prevent false positives. Which WAF feature supports this?

Accepted Answer

WAF Exclusion Lists

Answer

Custom Rules with Allow action

Answer

WAF Detection mode per route

Answer

Backend settings overrides

Question 5

What is the maximum number of custom rules you can define in a single Azure WAF policy attached to an Application Gateway?

Accepted Answer

100

Answer

25

Answer

50

Answer

500

Question 6

An administrator notices that a legitimate bot crawler is being blocked by the Azure Application Gateway WAF bot protection ruleset. Which configuration should be used to allow this specific bot?

Accepted Answer

Add the bot IP range to a WAF custom rule with Allow action and higher priority

Answer

Disable the bot protection managed ruleset entirely

Answer

Switch WAF to Detection mode only for that listener

Answer

Add the bot user-agent to the backend HTTP settings

Question 7

A WAF custom rule needs to match requests where the URI path starts with '/admin' AND the source IP is not in the corporate range 10.0.0.0/8. Which match condition operator handles the CIDR-based IP check?

Accepted Answer

IPMatch

Answer

Contains

Answer

GeoMatch

Answer

Regex