SC-100 Certification Practice Question #237

Question

You have an Azure subscription that contains App Service apps in four Azure regions. Users connect to the apps from the internet.

You plan to block requests to the apps if the requests contain security threats specified in the Core Rule Set (CRS) of the Open Web Application Security Project (OWASP).

You need to design a solution to block the requests. The solution must meet the following requirements:

•	Maintain access to the apps in the event of a region outage.
•	Minimize the number of resources required.

What should you include in the design? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The requirement to block requests matching the OWASP Core Rule Set points directly at Azure Web Application Firewall (the Front Door/App Gateway WAF Default Rule Set is built on the OWASP CRS). The two design constraints decide the host: "maintain access during a region outage" and "minimize the number of resources." Azure Front Door with WAF is a single global, edge-distributed resource whose WAF policy replicates to all edge locations and naturally survives a single region's outage, while Application Gateway is a regional resource that would require one deployment (and one WAF policy) per region — four regions here — failing both constraints. Azure Firewall Premium options (web categories, IDPS, threat-intelligence-based filtering) are network-layer features, not an OWASP web-application firewall, and Defender for App Service only detects threats rather than blocking requests. Community agreement is strong and well-reasoned (13 and 7 👍) and aligns with MS Learn.

More SC-100 practice questions