AZ-500 Secure networking Practice Question
A company deploys a web application on Azure VMs behind an Azure Load Balancer (Standard SKU). They want to protect the application from common web attacks like SQL injection and cross-site scripting. Which Azure service should they enable?
⚠ Common exam trap
It's easy for candidates to confuse Azure Firewall (a Layer 3-4 network firewall) with a web application firewall, mistakenly believing it can inspect HTTP payloads, when in fact only a Layer 7 WAF (like Application Gateway WAF or Azure Front Door WAF) can protect against SQL injection and XSS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway with Web Application Firewall (WAF) policy.
Azure Application Gateway with a Web Application Firewall (WAF) policy is the correct choice because it operates at Layer 7 (HTTP/HTTPS) and provides centralized, inbound protection against common web attacks such as SQL injection and cross-site scripting (XSS). The WAF policy uses OWASP Core Rule Sets (CRS) to inspect HTTP request payloads and headers, blocking malicious traffic before it reaches the backend VMs behind the Load Balancer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Application Gateway with Web Application Firewall (WAF) policy.
Why this is correct
Azure Application Gateway is a Layer 7 load balancer that can terminate TLS, route HTTP traffic, and enforce a Web Application Firewall policy using the Open Web Application Security Project (OWASP) Core Rule Set. The WAF inspects headers, body, cookies, and URL parameters to detect and block common attacks such as SQL injection, cross-site scripting, and remote file inclusion. This is the appropriate service because it operates at the application layer and can be integrated directly into the application delivery path for the VMs.
- ✗
Azure Firewall.
Why it's wrong here
Azure Firewall is a managed, cloud-native network security service that provides stateful filtering at Layers 3 and 4, along with FQDN-based outbound access control. It can restrict which DNS names and IP addresses the VMs can reach, but it does not parse or inspect HTTP request payloads, so it cannot detect a SQL injection string hidden inside a POST body. Basic and Standard tiers lack WAF features; even Premium's IDPS is not a substitute for a dedicated web application firewall.
- ✗
Network Security Groups on the VM subnet.
Why it's wrong here
Network Security Groups are stateful packet filters that allow or deny traffic based on source/destination IP addresses, ports, and protocols (TCP, UDP, ICMP). They evaluate traffic at the network layer and have no visibility into the contents of an HTTP message, including query strings, headers, or request bodies. Thus, while NSGs can restrict which clients reach the VM subnet on port 443, they cannot distinguish malicious application-layer requests from legitimate ones.
- ✗
Azure DDoS Protection.
Why it's wrong here
Azure DDoS Protection is designed to absorb volumetric (Layer 3/4) attacks like UDP floods, TCP SYN floods, and amplification attacks that aim to overwhelm bandwidth or connection tables. It does not examine the payload of web requests, so it cannot block SQL injection, cross-site scripting, or other application-layer attacks. In a defense-in-depth architecture, DDoS Protection complements a WAF, but it cannot fulfill the requirement of inspecting HTTP content itself.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.