WAF with Application Gateway in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does Azure WAF with Application Gateway handle SQL injection attacks?

Azure Web Application Firewall (WAF) integrated with Application Gateway is configured to protect a web app. What happens when a request contains a SQL injection attack pattern?

A The WAF logs the SQL injection attempt but allows the request to pass through to the backend.

B The WAF detects the SQL injection pattern and blocks the request before it reaches the backend web app.

C The Application Gateway drops the connection without logging or notifying.

D The Application Gateway forwards the request to the backend, and the backend server blocks the SQL injection.

💡 Hint

Think about where the WAF inspects traffic and its role in protecting the backend.

Azure WAF inspects incoming HTTP requests and blocks malicious patterns like SQL injection before they reach the backend, preventing attacks early.

❓ Configuration

intermediate

Which configuration enables WAF logging in Azure Application Gateway?

You want to enable logging for your Azure Application Gateway WAF to monitor blocked requests. Which configuration step is required?

A Enable Azure Monitor alerts on the backend VM to capture WAF logs.

B Configure backend health probes to log WAF events.

C Enable diagnostics logging in Application Gateway and send logs to a Log Analytics workspace.

D Set up a Network Security Group (NSG) flow log on the Application Gateway subnet.

💡 Hint

Consider where WAF logs are collected and how Azure services integrate for monitoring.

Diagnostics logging must be enabled on the Application Gateway resource and configured to send logs to a Log Analytics workspace for monitoring WAF events.

❓ Architecture

advanced

Designing a high availability WAF with Application Gateway

You need to design an Azure Application Gateway with WAF that remains available during zone failures. Which architecture ensures zone redundancy?

A Deploy Application Gateway with WAF SKU behind a Load Balancer in a single zone.

B Deploy multiple Application Gateways in different regions without zone redundancy.

C Use a single Application Gateway instance with WAF SKU in one availability zone only.

D Deploy Application Gateway with WAF SKU in multiple availability zones within the same region.

💡 Hint

Think about Azure's zone redundancy features and how Application Gateway supports them.

Deploying Application Gateway with WAF SKU across multiple availability zones in the same region provides zone redundancy and high availability during zone failures.

❓ security

advanced

Which WAF rule set mode blocks malicious requests by default?

Azure Application Gateway WAF supports different rule set modes. Which mode blocks malicious requests automatically?

A Prevention mode

B Detection mode

C Monitoring mode

D Audit mode

💡 Hint

Consider which mode actively stops attacks versus just reporting them.

Prevention mode actively blocks requests that match WAF rules, while detection mode only logs them without blocking.

✅ Best Practice

expert

What is the recommended approach to update WAF custom rules without downtime?

You have custom WAF rules configured on your Azure Application Gateway. How can you update these rules with minimal or no downtime?

A Edit the custom rules directly on the live Application Gateway; changes apply instantly without downtime.

B Delete the existing Application Gateway and recreate it with updated rules during off-hours.

C Use Azure Resource Manager templates to deploy a new Application Gateway with updated rules, then switch traffic using Azure Front Door.

D Disable WAF, update rules, then re-enable WAF on the same Application Gateway.

💡 Hint

Think about how to avoid impacting live traffic during configuration changes.

Custom WAF rules can be edited directly on the live Application Gateway's associated WAF policy; changes apply asynchronously without downtime or service interruption.