SC-100 Practice Question: Design solutions that align with security best practices and priorities

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Front Door with WAF

  Why it's wrong here

  Azure Front Door with WAF is a global entry point that provides anycast HTTP(S) load balancing and static content acceleration across Azure regions. While it does include a WAF, its purpose is to route traffic to the best regional origin, not to act as a local reverse proxy for a single-region web app. For a single application, Front Door is usually placed in front of Application Gateway for multi-region distribution, not as the sole protection layer.

• ✗

  Azure Firewall

  Why it's wrong here

  Azure Firewall is a stateful, network-level firewall that operates primarily at Layers 3 and 4, filtering traffic based on IP addresses, ports, and protocols, with some FQDN-based egress filtering. It does not perform deep packet inspection of HTTP/S payloads, so it cannot detect or block application-layer attacks like SQL injection, XSS, or cross-site request forgery. Thus, it cannot serve as a web application firewall for protecting a web application's front-end.

• ✗

  Azure DDoS Protection

  Why it's wrong here

  Azure DDoS Protection mitigates distributed denial-of-service attacks by monitoring and absorbing volumetric, protocol, and low-rate traffic floods at Azure's edge network. It ensures high availability during network-layer attacks but does not inspect application-layer request content or block malicious payloads such as SQL injection strings. A DDoS plan is a necessary baseline for availability, but it cannot substitute for a WAF that protects the application's actual HTTP endpoints.

• ✓

  Azure Application Gateway with WAF

  Why this is correct

  Azure Application Gateway with WAF is a regional Layer 7 load balancer that handles HTTP(S) traffic with features like cookie-based session affinity, URL-path routing, and SSL termination. Its WAF SKU enforces managed rule sets from the OWASP Core Rule Set, including rules that detect and block SQL injection, cross-site scripting, command injection, and other common exploits. This makes it the ideal choice for a single web app that needs application-layer inspection and protection close to the backend.

Go deeper

Related to this question