CV0-004 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Filtering malicious HTTP/HTTPS traffic to a web application

  Why this is correct

  A WAF inspects inbound HTTP/HTTPS requests at layer 7, applying rule sets to block SQL injection, cross-site scripting and similar payloads before they reach the web server. This directly satisfies the stem's requirement to filter malicious web traffic rather than merely logging or rate-limiting it.

• ✗

  Encrypting data at rest in a database

  Why it's wrong here

  Encryption at rest is delivered by storage or database platform features such as Transparent Data Encryption and Azure Storage Service Encryption; a WAF operates on inbound HTTP traffic and never touches stored data. It is tempting because WAFs handle TLS, but that protects data in transit, not data at rest.

• ✗

  Protecting against DDoS attacks at the network layer

  Why it's wrong here

  A WAF inspects HTTP/HTTPS request content to block injection and cross-site scripting, so it cannot filter the volumetric traffic that network-layer DDoS protection handles. It is tempting because WAFs do absorb some application-layer floods, but genuine Layer 3/4 scrubbing belongs to Azure DDoS Protection.

• ✗

  Managing user identities and access

  Why it's wrong here

  Identity and access management is performed by Microsoft Entra ID, which authenticates principals and issues tokens; a WAF only inspects inbound HTTP requests and cannot grant or revoke user access. It is tempting because WAFs enforce some request-level authorisation rules, but directory-level identity lifecycle remains outside their scope.

Go deeper

Related to this question