What is the primary purpose of setting a WAF policy to detection mode?

To monitor and log potential threats without blocking traffic

To block malicious traffic immediately

To allow all traffic through without inspection

A company uses Azure Front Door with WAF. They have a custom rule that blocks requests from a specific IP range, but they are seeing false positives where legitimate users from that range are blocked. They need to allow a specific path for those users. What is the most effective way to resolve this?

Use a managed rule set to allow the path.

Change the block rule to Detection mode.

Add a higher-priority custom rule that allows the specific path for the IP range.

Remove the IP range block rule entirely.

A company has multiple web applications, each with different security requirements. One application is public-facing and requires WAF, while another is internal and should not have WAF overhead. They use Azure Front Door for both. What is the most efficient way to configure WAF for this scenario?

Create a single WAF policy and associate it with the Front Door profile.

Enable WAF only on the internal app and leave the public app unprotected.

Create separate WAF policies and associate them with the respective Front Door endpoints.

Use Application Gateway for the public app and Front Door for the internal app.

A company has a multi-region web application deployed behind Azure Front Door. They want to use WAF to protect against DDoS attacks and application-layer attacks. They also have a compliance requirement to log all WAF actions. What is the most appropriate design?

Enable Azure DDoS Protection on the origin and use Front Door WAF with logging to Log Analytics.

Use only Azure Application Gateway WAF and enable DDoS Protection on the VNet.

Use a third-party WAF and DDoS service.

Use Front Door WAF in Detection mode and rely on DDoS Protection for blocking.

A company is deploying a WAF for the first time and wants to ensure that legitimate traffic is not blocked. They plan to run the WAF in Detection mode for two weeks. What should they do with the logs during this period?

Analyze the logs to identify any legitimate requests that match WAF rules.

Delete the logs to save storage.

Only review the logs if users report issues.

Ignore the logs and switch to Prevention mode after two weeks.

Microsoft Certified:Azure Network Engineer Associate

Domain 5Objective 3

Design and Implement a Web Application Firewall (WAF) Deployment AZ-700 Practice Questions (Page 4)

Part of the Design and implement Azure network security services domain, which accounts for 15–20% of the AZ-700 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 2–4 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

5concepts

15–20%of the exam

Questions 16–20

16foundation · easy
What is the primary purpose of setting a WAF policy to detection mode?
Select an answer first
17expert · hard
A company uses Azure Front Door with WAF. They have a custom rule that blocks requests from a specific IP range, but they are seeing false positives where legitimate users from that range are blocked. They need to allow a specific path for those users. What is the most effective way to resolve this?
Select an answer first
18application · medium
A company has multiple web applications, each with different security requirements. One application is public-facing and requires WAF, while another is internal and should not have WAF overhead. They use Azure Front Door for both. What is the most efficient way to configure WAF for this scenario?
Select an answer first
19expert · hard
A company has a multi-region web application deployed behind Azure Front Door. They want to use WAF to protect against DDoS attacks and application-layer attacks. They also have a compliance requirement to log all WAF actions. What is the most appropriate design?
Select an answer first
20application · medium
A company is deploying a WAF for the first time and wants to ensure that legitimate traffic is not blocked. They plan to run the WAF in Detection mode for two weeks. What should they do with the logs during this period?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-700

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-700” is a trademark of its owner, used for identification only.