AZ-500 Secure networking Practice Question
You have an Azure Web Application Firewall (WAF) policy associated with an Azure Front Door instance. You want to block requests from a specific country (e.g., Country X) unless the request includes a valid API key. How should you configure this?
⚠ Common exam trap
Many candidates think geo-blocking must be done with a single rule or that managed rule sets can handle geography, but Azure WAF requires custom rules for geo-filtering and relies on rule priority to implement conditional overrides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a geo-match custom rule to block Country X, and create a separate custom rule with higher priority to allow traffic from Country X if the request contains the API key header.
Azure WAF custom rules are evaluated in priority order, and a higher-priority 'allow' rule can override a lower-priority 'block' rule. By creating a geo-match rule to block Country X, and then a separate custom rule with a higher priority (lower numeric value) that allows requests from Country X if they contain a valid API key header, you achieve the conditional access requirement. This leverages WAF's ability to inspect request headers and apply logic based on multiple conditions within a single policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a geo-match custom rule to allow all countries except Country X, and use a rate limit rule to block Country X.
Why it's wrong here
Using a geo-match rule to allow all countries except Country X does not actively block Country X; it merely means that rule does not allow it, and other rules still apply. A rate limit rule in Azure WAF throttles requests based on aggregate client counts such as per IP or per session, not based on geographic origin, so it cannot selectively block an entire country. Even with a low threshold, it would only intermittently deny or delay traffic, not provide the deterministic country block that the requirement demands. The correct geo-based action is a custom rule with action Block for the Country X match.
- ✗
Configure IP restriction on the origin to block Country X IPs.
Why it's wrong here
Configuring IP restriction on the origin server to block Country X is impractical because the origin's IP-filtering features do not maintain accurate, dynamic country-to-IP mappings. An origin-level IP restriction would also indiscriminately drop all traffic from Country X, including legitimate requests that carry the required API key header, unless the origin separately inspects that header before applying the restriction. This bypasses the WAF layer entirely, loses centralized policy management and logging benefits, and is less maintainable than a geo-match custom rule within the WAF policy.
- ✗
Configure the WAF policy to use 'Prevention' mode and add a managed rule set that includes the country block.
Why it's wrong here
Setting the WAF policy to Prevention mode only affects how managed rule set rules act—changing them from log-only to block—but the OWASP CRS and other default managed rule sets do not include country-based match conditions. Geo-filtering is not included in managed rule sets; it must be implemented as a custom rule with a Geo-match condition. Therefore, adding a managed rule set cannot block Country X regardless of the WAF policy mode, so this option fails to meet the requirement.
- ✓
Use a geo-match custom rule to block Country X, and create a separate custom rule with higher priority to allow traffic from Country X if the request contains the API key header.
Why this is correct
This approach works because Azure WAF evaluates custom rules in strict priority order, with lower numeric priority values evaluated first. Create an allow custom rule with a higher priority (for example, priority 1) that matches requests from Country X only when the required API key header is present and sets the action to Allow; then create a lower-priority block rule (for example, priority 2) with a geo-match condition for Country X. When a request from Country X contains the API key, the allow rule matches first and stops further evaluation, bypassing the block rule. Requests from Country X without the API key do not match the allow rule, fall through to the block rule, and are denied.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.