Hotspot Question You are implementing an Azure Application Gateway web application firewall (WAF) named WAF1. You have the following Bicep code snippet. For each of the following statements, select…

Question

Exhibit

Answer Area

• A request to the backend pool from IP address 10.1.1.5 is allowed.
• Incoming requests attempting file path attacks are blocked.
• WAF1 allows a 50-MB file to be uploaded.

Explanation

This hotspot question tests knowledge of Azure Application Gateway WAF Bicep configuration, specifically how WAF policy settings like mode, rule sets, and exclusions are interpreted from code.

Approach. To answer hotspot questions about Bicep/ARM code for Azure WAF, you must carefully read each property in the code: 'mode' determines Prevention vs Detection, 'managedRules' defines which OWASP/CRS rule sets are active, 'exclusions' define what is excluded from inspection, and 'requestBodyCheck' or 'fileUploadLimitInMb' set inspection limits. Map each statement against the literal values in the Bicep snippet - if the code shows mode: 'Prevention', then WAF1 is in Prevention mode (Yes); if no custom rules block are defined, then no custom rules exist (Yes/No accordingly). Always verify property names and their boolean or string values precisely, as WAF behavior is entirely determined by these configuration values.

Concept tested. Azure Application Gateway WAF Bicep configuration interpretation - understanding WAF modes (Detection vs Prevention), managed rule sets (OWASP CRS versions), custom rules, exclusions, and policy settings as expressed in Infrastructure-as-Code (Bicep) syntax.

Reference. https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-waf-configuration and https://learn.microsoft.com/en-us/azure/templates/microsoft.network/applicationgatewayfirewallpolicies

No community discussion yet for this question.