Microsoft Certified: Azure Administrator AssociateImplement and manage virtual networkingMedium
An organization requires that all inbound traffic to a specific web application hosted on Azure Virtual Machines must first pass through a Web Application Firewall (WAF) to protect against common web vulnerabilities. The WAF must be integrated with a Layer 7 load balancer that provides SSL termination. The solution needs to be deployed regionally within a single Azure region. Which Azure networking service combines WAF capabilities with Layer 7 load balancing and SSL termination?
- AAzure Front Door with Azure WAF
- BAzure Application Gateway with Azure WAF
- CAzure Firewall with a custom reverse proxy
- DAzure Load Balancer with Network Security Groups (NSGs)
Show answer & explanationAnswer & explanation
Correct answer: B. Azure Application Gateway with Azure WAF
Azure Application Gateway is a Layer 7 load balancer that inherently supports SSL termination and offers an integrated Web Application Firewall (WAF) SKU. This combination directly meets all requirements for regional web application protection and traffic distribution.
Why the other options are wrong
- A. Azure Front Door provides WAF and Layer 7 capabilities, but it's a global service. The requirement specifies a regional deployment.
- C. Azure Firewall is a Layer 3/4 firewall, not a Layer 7 load balancer with SSL termination, and would require a separate reverse proxy for the stated functionality.
- D. Azure Load Balancer is Layer 4 and does not provide WAF or SSL termination at the load balancer level. NSGs are for basic Layer 4 filtering.
Application Gateway WAF
A Web Application Firewall (WAF) SKU integrated with Azure Application Gateway, providing protection against common web-based attacks.
- Protects against OWASP Top 10 vulnerabilities.
- Operates at Layer 7 (HTTP/HTTPS).
- Can be enabled on existing Application Gateway instances.
Memory trick: App Gateway for regional WAF, Front Door for global WAF.