WAF with Application Gateway in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does Azure WAF with Application Gateway handle SQL injection attacks?

Azure Web Application Firewall (WAF) integrated with Application Gateway is configured to protect a web app. What happens when a request contains a SQL injection attack pattern?

A The WAF logs the SQL injection attempt but allows the request to pass through to the backend.

B The WAF detects the SQL injection pattern and blocks the request before it reaches the backend web app.

C The Application Gateway drops the connection without logging or notifying.

D The Application Gateway forwards the request to the backend, and the backend server blocks the SQL injection.

💡 Hint

Think about where the WAF inspects traffic and its role in protecting the backend.

Azure WAF inspects incoming HTTP requests and blocks malicious patterns like SQL injection before they reach the backend, preventing attacks early.

❓ Configuration

intermediate

Which configuration enables WAF logging in Azure Application Gateway?

You want to enable logging for your Azure Application Gateway WAF to monitor blocked requests. Which configuration step is required?

A Enable Azure Monitor alerts on the backend VM to capture WAF logs.

B Configure backend health probes to log WAF events.

C Enable diagnostics logging in Application Gateway and send logs to a Log Analytics workspace.

D Set up a Network Security Group (NSG) flow log on the Application Gateway subnet.

💡 Hint

Consider where WAF logs are collected and how Azure services integrate for monitoring.

Diagnostics logging must be enabled on the Application Gateway resource and configured to send logs to a Log Analytics workspace for monitoring WAF events.

❓ Architecture

advanced

Designing a high availability WAF with Application Gateway

You need to design an Azure Application Gateway with WAF that remains available during zone failures. Which architecture ensures zone redundancy?

A Deploy Application Gateway with WAF SKU behind a Load Balancer in a single zone.

B Deploy multiple Application Gateways in different regions without zone redundancy.

C Use a single Application Gateway instance with WAF SKU in one availability zone only.

D Deploy Application Gateway with WAF SKU in multiple availability zones within the same region.

💡 Hint

Think about Azure's zone redundancy features and how Application Gateway supports them.

Deploying Application Gateway with WAF SKU across multiple availability zones in the same region provides zone redundancy and high availability during zone failures.

❓ security

advanced

Which WAF rule set mode blocks malicious requests by default?

Azure Application Gateway WAF supports different rule set modes. Which mode blocks malicious requests automatically?

A Prevention mode

B Detection mode

C Monitoring mode

D Audit mode

💡 Hint

Consider which mode actively stops attacks versus just reporting them.

Prevention mode actively blocks requests that match WAF rules, while detection mode only logs them without blocking.

✅ Best Practice

expert

What is the recommended approach to update WAF custom rules without downtime?

You have custom WAF rules configured on your Azure Application Gateway. How can you update these rules with minimal or no downtime?

A Edit the custom rules directly on the live Application Gateway; changes apply instantly without downtime.

B Delete the existing Application Gateway and recreate it with updated rules during off-hours.

C Use Azure Resource Manager templates to deploy a new Application Gateway with updated rules, then switch traffic using Azure Front Door.

D Disable WAF, update rules, then re-enable WAF on the same Application Gateway.

💡 Hint

Think about how to avoid impacting live traffic during configuration changes.

Custom WAF rules can be edited directly on the live Application Gateway's associated WAF policy; changes apply asynchronously without downtime or service interruption.

Practice

1. What is the main purpose of enabling WAF (Web Application Firewall) on an Azure Application Gateway?

easy

A. To provide a database backup solution

B. To protect web applications from common web attacks like SQL injection and cross-site scripting

C. To increase the speed of the web application by caching content

D. To monitor network traffic at the virtual network level

Solution

1. Step 1: Understand WAF's role

   WAF is designed to protect web apps by filtering and monitoring HTTP traffic to block common attacks.

2. Step 2: Compare options

   Only To protect web applications from common web attacks like SQL injection and cross-site scripting describes protection from web attacks, which is the core function of WAF.

3. Final Answer:

   To protect web applications from common web attacks like SQL injection and cross-site scripting -> Option B

4. Quick Check:

   WAF protects web apps = C [OK]

Hint: WAF blocks web attacks, not speeds or backups [OK]

Common Mistakes:

• Confusing WAF with caching or backup services
• Thinking WAF monitors network traffic broadly
• Assuming WAF improves app speed

2. Which of the following is the correct way to enable WAF on an Azure Application Gateway using ARM template syntax?

easy

A. "sku": { "name": "WAF_v2" }, "wafConfiguration": { "enabled": true, "firewallMode": "Prevention" }

B. "sku": { "name": "Standard_v2" }, "wafConfiguration": { "enabled": true }

C. "sku": { "name": "Basic" }, "wafConfiguration": { "enabled": false }

D. "sku": { "name": "WAF_v1" }, "wafConfiguration": { "enabled": false, "firewallMode": "Detection" }

Solution

1. Step 1: Identify correct SKU for WAF

   WAF requires SKU like "WAF_v2" or "WAF_v1"; Standard_v2 or Basic do not enable WAF.

2. Step 2: Check WAF configuration

   WAF must be enabled with "enabled": true and a valid firewallMode like "Prevention" or "Detection".

3. Final Answer:

   "sku": { "name": "WAF_v2" }, "wafConfiguration": { "enabled": true, "firewallMode": "Prevention" } -> Option A

4. Quick Check:

   WAF SKU + enabled true + mode = A [OK]

Hint: WAF needs WAF SKU and enabled true [OK]

Common Mistakes:

• Using Standard or Basic SKU without WAF
• Setting enabled to false when enabling WAF
• Omitting firewallMode or using invalid values

3. Given this snippet of ARM template for Application Gateway WAF configuration:

{
  "sku": { "name": "WAF_v2" },
  "wafConfiguration": {
    "enabled": true,
    "firewallMode": "Detection"
  }
}

What will be the behavior of the Application Gateway regarding detected threats?

medium

A. It will log detected threats but allow traffic to pass through

B. It will block detected threats and return an error to clients

C. It will ignore detected threats and not log them

D. It will shut down the Application Gateway on threat detection

Solution

1. Step 1: Understand firewallMode 'Detection'

   Detection mode means WAF monitors and logs threats but does not block traffic.

2. Step 2: Compare options with behavior

   Only It will log detected threats but allow traffic to pass through matches detection mode behavior: logging threats but allowing traffic.

3. Final Answer:

   It will log detected threats but allow traffic to pass through -> Option A

4. Quick Check:

   Detection mode = log only, no block = B [OK]

Hint: Detection mode logs but does not block [OK]

Common Mistakes:

• Confusing Detection with Prevention mode
• Assuming threats are blocked in Detection mode
• Thinking Application Gateway shuts down on threats

4. You configured WAF on Application Gateway with this snippet:

{
  "sku": { "name": "WAF_v2" },
  "wafConfiguration": {
    "enabled": true,
    "firewallMode": "Prevention"
  }
}

But the WAF is not blocking malicious requests. What is the most likely cause?

medium

A. The Application Gateway is missing a listener configuration

B. The SKU name "WAF_v2" does not support prevention mode

C. The WAF policy is not associated with the Application Gateway

D. The firewallMode should be set to Detection to block requests

Solution

1. Step 1: Check WAF policy association

   Even if WAF is enabled, it must have a WAF policy linked to enforce rules and block threats.

2. Step 2: Validate other options

   Listener is required but unrelated to blocking; prevention mode blocks; WAF_v2 supports prevention mode.

3. Final Answer:

   The WAF policy is not associated with the Application Gateway -> Option C

4. Quick Check:

   WAF policy association needed to block = D [OK]

Hint: WAF needs policy linked to block threats [OK]

Common Mistakes:

• Confusing detection and prevention modes
• Forgetting to associate WAF policy
• Assuming SKU limits prevention mode

5. You want to protect your web app with Azure Application Gateway WAF in prevention mode but also need to monitor false positives before blocking. What is the best approach to achieve this?

hard

A. Use Basic SKU Application Gateway with WAF enabled

B. Enable WAF in prevention mode immediately and block all detected threats

C. Disable WAF and rely on network security groups for protection

D. Enable WAF in detection mode first, review logs, then switch to prevention mode

Solution

1. Step 1: Understand prevention vs detection modes

   Prevention mode blocks threats immediately; detection mode only logs them for review.

2. Step 2: Plan safe deployment

   Start with detection mode to identify false positives, then switch to prevention to block real threats safely.

3. Final Answer:

   Enable WAF in detection mode first, review logs, then switch to prevention mode -> Option D

4. Quick Check:

   Detect first, then prevent = A [OK]

Hint: Detect first, then switch to prevention mode [OK]

Common Mistakes:

• Blocking immediately without monitoring false positives
• Disabling WAF and relying on unrelated protections
• Using Basic SKU which does not support WAF