AZ-900 Describe Azure architecture and services Practice Question
Which Azure service provides network filtering to protect web applications from common exploits like SQL injection and cross-site scripting?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Firewall (a general network firewall) with Azure WAF (an application-layer firewall), because both have 'firewall' in their name, but they operate at different OSI layers and serve distinct purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Web Application Firewall (WAF)
Azure Web Application Firewall (WAF) is specifically designed to inspect and filter HTTP/HTTPS traffic at the application layer (Layer 7). It uses rule sets like the OWASP Core Rule Set to detect and block common web exploits such as SQL injection and cross-site scripting (XSS), making it the correct choice for protecting web applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a managed cloud firewall service that primarily enforces network-level policies, such as IP addresses, ports, and protocols, though it also supports FQDN filtering and threat intelligence-based alerts. It does not deeply inspect HTTP request bodies or URL parameters against OWASP Top 10 patterns, so it can't differentiate a benign request from a web exploit. Thus, while Azure Firewall is valuable for a central perimeter control, it is not a purpose-built Web Application Firewall.
- ✗
Azure DDoS Protection
Why it's wrong here
Azure DDoS Protection is designed to mitigate large-scale volumetric attacks, such as SYN floods and UDP amplification, by absorbing malicious traffic at the network layer (layers 3 and 4). It ensures availability during a DDoS event but does not analyze the content of HTTP requests or look for application-layer vulnerabilities. Because web app attacks are small, subtle requests hidden inside normal traffic, DDoS Protection would not detect or prevent SQL injection or cross-site scripting.
- ✗
Network Security Groups (NSG)
Why it's wrong here
Network Security Groups (NSGs) are stateful packet filters that evaluate traffic at layers 3 and 4, using rules based on source/destination IP, port, and protocol. This allows them to block traffic from known malicious IPs or on suspicious ports, but they cannot inspect the actual HTTP request payload. Therefore, an NSG cannot identify or block a SQL injection or XSS attempt, making it insufficient for web application protection.
- ✓
Azure Web Application Firewall (WAF)
Why this is correct
Azure Web Application Firewall (WAF) is the correct choice because it operates at layer 7 and inspects HTTP(S) requests for malicious patterns, including SQL injection, cross-site scripting, and other OWASP Top 10 risks. It can be deployed with Azure Application Gateway, Front Door, or CDN, and it can be configured with managed rule sets. WAF specifically blocks or alerts on attacks based on request content, making it the only service among these that protects against web application exploits.
Go deeper
Related to this question
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.