AZ-800 Application Gateway and WAF 5

Question 1

An Application Gateway is deployed in a dedicated subnet. What is the minimum subnet size recommended for a production WAF_v2 deployment with autoscaling up to 125 instances?

Accepted Answer

/24 (256 addresses)

Answer

/29 (8 addresses)

Answer

/28 (16 addresses)

Answer

/27 (32 addresses)

Question 2

A company migrates from Application Gateway v1 to v2. What is the public IP address requirement for v2?

Accepted Answer

v2 requires a Standard SKU static public IP address

Answer

v2 supports both static and dynamic public IPs

Answer

v2 uses dynamic IP only and assigns at runtime

Answer

v2 shares the IP with Azure Load Balancer automatically

Question 3

An operations team wants to monitor WAF blocked requests in real time. Which Azure service should they configure to stream WAF logs for analysis?

Accepted Answer

Azure Monitor Diagnostic Settings to Log Analytics or Event Hub

Answer

Azure Service Bus

Answer

Azure Sentinel only via ARM template

Answer

Azure Traffic Manager health checks

Question 4

A backend pool contains three VMs. One VM is consistently causing HTTP 502 errors. Which Application Gateway log should be checked first to diagnose backend connectivity issues?

Accepted Answer

ApplicationGatewayAccessLog

Answer

ApplicationGatewayFirewallLog

Answer

ApplicationGatewayPerformanceLog

Answer

ApplicationGatewayBackendHealthLog

Question 5

An Application Gateway needs to inspect and route gRPC traffic. Which protocol must be configured in the listener to support gRPC?

Accepted Answer

HTTP/2 with HTTPS listener

Answer

TCP with custom port

Answer

WebSocket upgrade header

Answer

UDP with custom health probe

Question 6

A company wants to integrate Azure Application Gateway with Azure Firewall in a hub-spoke topology so that traffic flows Internet → Application Gateway (WAF) → Azure Firewall → Backend. What is this security pattern commonly called?

Accepted Answer

Sandwich topology

Answer

Zero-trust perimeter model

Answer

Hub-spoke with shared services

Answer

Forced tunneling egress model

Question 7

After enabling WAF, a legitimate multipart file upload fails with a 403 error triggered by WAF rule 200002. What is the best remediation that avoids broadly disabling WAF protection?

Accepted Answer

Add an exclusion for the specific file upload field or disable only rule 200002

Answer

Switch WAF to Detection mode globally

Answer

Increase the WAF request body size limit to maximum

Answer

Disable the entire OWASP managed ruleset