AZ-900 Describe Azure architecture and services Practice Question
Which Azure service acts as a reverse proxy with Web Application Firewall (WAF) capabilities to protect web applications from common web exploits?
⚠ Common exam trap
It's easy for candidates to confuse Azure Firewall (a network-layer firewall) with Application Gateway (a Layer 7 reverse proxy), mistakenly thinking any 'firewall' service can provide web application protection, but only Application Gateway with WAF offers dedicated Layer 7 inspection and OWASP-based exploit blocking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Application Gateway with WAF
Azure Application Gateway with WAF is the correct choice because it operates as a Layer 7 reverse proxy, inspecting HTTP/HTTPS traffic and using a Web Application Firewall (WAF) to block common exploits such as SQL injection and cross-site scripting (XSS). The WAF is based on the OWASP Core Rule Set (CRS), providing centralized protection for web applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a managed network security service that operates at layers 3 and 4, filtering traffic based on IP addresses, ports, and protocols. While it can provide stateful inspection and centralized policy enforcement, it does not parse HTTP request payloads for application-layer exploits such as SQL injection or cross-site scripting. Therefore, it cannot deliver the web-specific protection described in the scenario, which requires a Web Application Firewall.
- ✓
Azure Application Gateway with WAF
Why this is correct
Azure Application Gateway with WAF is a layer-7 load balancer that includes a Web Application Firewall designed to protect web applications from OWASP Top 10 vulnerabilities. It inspects HTTP/HTTPS traffic in depth, blocking malicious payloads like SQL injection and XSS at the application edge. Because it operates at the application layer, it is the correct choice for this security requirement, unlike network-level filtering solutions.
- ✗
Network Security Groups
Why it's wrong here
Network Security Groups filter traffic using rules based on source and destination IP addresses, ports, and protocols, functioning as a stateful packet filter at layers 3 and 4. They can segment virtual networks and control east-west traffic, but they have no visibility into the HTTP payload content found in layer-7 requests. As a result, NSGs cannot detect or block application-layer attacks like SQL injection, so they are not the right mechanism for this scenario.
- ✗
Azure DDoS Protection
Why it's wrong here
Azure DDoS Protection mitigates large-scale volumetric attacks, protocol attacks, and resource-layer attacks that target network availability, operating at layers 3 and 4. It uses always-on monitoring and adaptive tuning to absorb attack traffic, but it does not inspect the content of HTTP requests for web exploits. Its purpose is to ensure uptime during floods, not to protect application logic from OWASP vulnerabilities, making it incorrect for this requirement.
Go deeper
Related to this question
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.