AZ-800 Application Gateway and WAF 5 — Questions and Answers
Question 1: An Application Gateway is deployed in a dedicated subnet. What is the minimum subnet size recommended for a production WAF_v2 deployment with autoscaling up to 125 instances?
- /29 (8 addresses)
- /28 (16 addresses)
- /24 (256 addresses) (Correct answer)
- /27 (32 addresses)
Correct answer: /24 (256 addresses)
Microsoft recommends a /24 subnet for Application Gateway v2 production deployments to accommodate autoscaling and avoid address exhaustion.
Question 2: A company migrates from Application Gateway v1 to v2. What is the public IP address requirement for v2?
- v2 supports both static and dynamic public IPs
- v2 requires a Standard SKU static public IP address (Correct answer)
- v2 uses dynamic IP only and assigns at runtime
- v2 shares the IP with Azure Load Balancer automatically
Correct answer: v2 requires a Standard SKU static public IP address
Application Gateway v2 requires a Standard SKU static public IP address; Basic SKU or dynamic IPs are not supported.
Question 3: An operations team wants to monitor WAF blocked requests in real time. Which Azure service should they configure to stream WAF logs for analysis?
- Azure Service Bus
- Azure Monitor Diagnostic Settings to Log Analytics or Event Hub (Correct answer)
- Azure Sentinel only via ARM template
- Azure Traffic Manager health checks
Correct answer: Azure Monitor Diagnostic Settings to Log Analytics or Event Hub
WAF logs (ApplicationGatewayFirewallLog) can be streamed to Log Analytics, Event Hub, or Storage via Azure Monitor Diagnostic Settings.
Question 4: A backend pool contains three VMs. One VM is consistently causing HTTP 502 errors. Which Application Gateway log should be checked first to diagnose backend connectivity issues?
- ApplicationGatewayFirewallLog
- ApplicationGatewayAccessLog (Correct answer)
- ApplicationGatewayPerformanceLog
- ApplicationGatewayBackendHealthLog
Correct answer: ApplicationGatewayAccessLog
The ApplicationGatewayAccessLog records all request-response details including backend server responses, making it the primary log for diagnosing 502 errors.
Question 5: An Application Gateway needs to inspect and route gRPC traffic. Which protocol must be configured in the listener to support gRPC?
- TCP with custom port
- HTTP/2 with HTTPS listener (Correct answer)
- WebSocket upgrade header
- UDP with custom health probe
Correct answer: HTTP/2 with HTTPS listener
gRPC uses HTTP/2 as its transport; Application Gateway must be configured with an HTTPS listener with HTTP/2 enabled to support gRPC traffic.
Question 6: A company wants to integrate Azure Application Gateway with Azure Firewall in a hub-spoke topology so that traffic flows Internet → Application Gateway (WAF) → Azure Firewall → Backend. What is this security pattern commonly called?
- Sandwich topology (Correct answer)
- Zero-trust perimeter model
- Hub-spoke with shared services
- Forced tunneling egress model
Correct answer: Sandwich topology
The 'sandwich' topology places Application Gateway (Layer 7 WAF) in front and Azure Firewall (Layer 4 + IDPS) behind it, providing layered security inspection.
Question 7: After enabling WAF, a legitimate multipart file upload fails with a 403 error triggered by WAF rule 200002. What is the best remediation that avoids broadly disabling WAF protection?
- Switch WAF to Detection mode globally
- Add an exclusion for the specific file upload field or disable only rule 200002 (Correct answer)
- Increase the WAF request body size limit to maximum
- Disable the entire OWASP managed ruleset
Correct answer: Add an exclusion for the specific file upload field or disable only rule 200002
Adding a targeted exclusion for the file upload field or disabling the specific rule 200002 addresses the false positive without compromising other WAF protections.
AZ-800 Application Gateway and WAF 5
An Application Gateway is deployed in a dedicated subnet.
What is the minimum subnet size recommended for a production WAF_v2 deployment with autoscaling up to 125 instances?