Microsoft Certified: Azure Solutions Architect ExpertDesign infrastructure solutionsMedium
A media company hosts a public-facing web application in Azure. The application is a common target for various web-based attacks, including SQL injection, cross-site scripting (XSS), and DDoS attacks. The company needs a solution to protect the application from these common web vulnerabilities and to filter malicious traffic before it reaches the backend servers. Which Azure networking service should be implemented?
- AAzure Web Application Firewall (WAF)
- BAzure DDoS Protection Standard
- CAzure Firewall
- DAzure Network Security Group (NSG)
Show answer & explanationAnswer & explanation
Correct answer: A. Azure Web Application Firewall (WAF)
Azure Web Application Firewall (WAF) provides centralized protection of web applications from common exploits and vulnerabilities such as SQL injection and cross-site scripting. It operates at Layer 7 (application layer) and can be deployed with Azure Application Gateway or Azure Front Door, making it ideal for public-facing web apps.
Why the other options are wrong
- B. Azure DDoS Protection Standard protects against volumetric and protocol-based DDoS attacks but does not mitigate application-layer web vulnerabilities.
- C. Azure Firewall is a managed cloud-based network security service that protects Azure Virtual Network resources but does not offer specific application-layer web attack protection like WAF.
- D. NSGs operate at Layer 4 (transport layer) and Layer 3 (network layer), providing basic traffic filtering, but cannot protect against application-layer attacks like SQL injection or XSS.
Azure Web Application Firewall (WAF)
A feature of Azure Application Gateway and Azure Front Door that provides centralized protection of web applications from common exploits and vulnerabilities, such as SQL injection, cross-site scripting, and other OWASP Top 10 risks.
- Protects against common web vulnerabilities (OWASP Top 10)
- Operates at Layer 7 (Application Layer)
- Can be deployed with Application Gateway or Front Door
- Provides real-time threat intelligence
Memory trick: For web attacks, 'WAF' is the 'W'all 'A'gainst 'F'aults.