AZ-500 Secure networking Practice Question
A company uses Azure Front Door to accelerate and secure its public web application. The security team wants to limit the number of requests from a single client IP address to 100 per minute to prevent a single user from overwhelming the backend. Which configuration should they add to the Web Application Firewall (WAF) policy associated with the Front Door?
⚠ Common exam trap
Test-takers frequently confuse rate limiting with bot protection or managed rule sets, assuming that enabling a managed rule set or bot protection will automatically handle request throttling, but neither provides per-IP rate limiting—they focus on attack signatures and bot detection, respectively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a custom rule with a rate limit condition.
Azure Front Door's WAF supports custom rate limit rules that can restrict the number of requests from a single client IP address within a specified time window. By creating a custom rule with a rate limit condition set to 100 requests per minute, the security team can prevent a single client from overwhelming the backend while allowing legitimate traffic. This is the only option that directly addresses the requirement to limit requests per client IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a custom rule with a rate limit condition.
Why this is correct
Azure Front Door's WAF supports custom rules with a rate limit condition, which tracks the number of requests from a client IP address within a defined time window (e.g., 60 seconds). Once the threshold is exceeded, you can specify an action such as Block to immediately drop subsequent requests until the window resets. This is the only option that directly implements per-IP request throttling to protect against aggressive scraping or brute-force attempts, making it the correct choice for the stated requirement.
- ✗
Enable a managed rule set for the WAF policy.
Why it's wrong here
Managed rule sets, such as Microsoft_DefaultRuleSet or OWASP, are curated collections of signatures that detect common web attacks like SQL injection and cross-site scripting. These rules inspect individual request content and are stateless, meaning they do not monitor the frequency of requests from any given client. While they add valuable baseline security, they offer no mechanism to limit the number of requests per IP, so they fail to address the rate-based attack scenario.
- ✗
Configure a bot protection rule set.
Why it's wrong here
Bot protection rule sets in Azure Front Door use managed bot classification based on user-agent, IP reputation, and behavioral signals to identify and mitigate automated traffic, such as crawlers or malicious bots. They operate by categorizing traffic as allowed, blocked, or logged, but they do not track the cumulative request count from a source over a sliding time window. Consequently, they cannot enforce a rate limit on a legitimate but hostile IP; they only distinguish bot-like behavior, leaving high-volume non-bot requests unaffected.
- ✗
Set a geolocation filter to block all traffic except from allowed countries.
Why it's wrong here
A geolocation filtering rule matches requests based on the geographic location derived from the client IP address, allowing you to permit or deny traffic from specific countries or regions. This rule evaluates the request's origin, not the rate at which it arrives, so it cannot detect or block an IP that sends an abnormally high number of requests. It would only be useful if the attack originates from a country you choose to block, but it provides no protection when a single IP inside an allowed country floods the front door.
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.