Respond to security incidents →hardMultiple Choice

SC-200 Respond to security incidents Practice Question

Exhibit

Refer to the exhibit.
```json
{
  "displayName": "Malicious IP Block Rule",
  "properties": {
    "rules": [
      {
        "name": "BlockMaliciousIP",
        "matchConditions": [
          {
            "matchVariable": "RemoteAddr",
            "operator": "IPMatch",
            "matchValue": "10.0.0.1"
          }
        ],
        "action": {
          "type": "Block"
        }
      }
    ]
  }
}
```

Refer to the exhibit. This JSON snippet is from an Azure Web Application Firewall (WAF) policy. What does this rule do?

⚠ Common exam trap

Candidates often confuse an exact IP match with a subnet match, assuming '10.0.0.1' implies the entire /24 range, or they misread the 'Block' action as 'Allow' or 'Log' due to familiarity with other WAF rule types.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Blocks traffic originating from IP address 10.0.0.1.

The JSON snippet defines a WAF rule with a match condition that checks if the client IP address equals 10.0.0.1. The action is set to 'Block', meaning any request from that specific IP address will be denied. Option B correctly identifies this behavior.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Blocks traffic from the entire 10.0.0.0/24 subnet.
Why it's wrong here
The match condition defines RemoteAddr with Operator 'IPMatch' and Value '10.0.0.1'. The IPMatch operator, when given a literal address without a CIDR suffix, matches exactly that single IP address, not the entire /24 range. To block a subnet, you would need the value '10.0.0.0/24' or multiple match conditions. Therefore, this does not block the whole 10.0.0.0/24 subnet.
✓
Blocks traffic originating from IP address 10.0.0.1.
Why this is correct
The rule's match condition uses RemoteAddr as the source operand, IPMatch as the operator, and the literal value '10.0.0.1', meaning it matches requests whose client IP is exactly 10.0.0.1. The action specified is 'Block', so any request from that source IP is denied. Consequently, it correctly blocks traffic originating from that single IP address.
✗
Logs traffic from IP address 10.0.0.1 without blocking.
Why it's wrong here
The configured action for this rule is 'Block', not 'Log'. In Azure WAF, 'Log' is a separate action that records the request without intervening, whereas 'Block' actively denies the request. Since the JSON explicitly sets Action to 'Block', the rule does not simply log traffic; it rejects it. Thus, describing it as log-only is incorrect.
✗
Allows traffic from IP address 10.0.0.1.
Why it's wrong here
This rule's action is 'Block', which instructs Azure WAF to deny the request, not to permit it. An 'Allow' action would be required to let traffic through, but that is not present here. Therefore, the rule blocks, rather than allows, traffic from IP 10.0.0.1.

Go deeper

SC-200 Respond to security incidents Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question