One site is regional-only behind Application Gateway; another is global behind Front Door. Where should the security engineer attach WAF policies?
Select an answer to reveal the explanation.
Short Explanation
WAF is a policy that rides on the host you already chose—Application Gateway WAF_v2 regionally, Front Door WAF globally. Firewall IDPS is useful, but it isn’t that WAF.
Full Explanation
WAF policies attach to the host that matches the architecture: associate a WAF policy with Application Gateway WAF_v2 for the regional-only canal site and with Front Door WAF for the global site. Azure Firewall Premium IDPS remains valuable for network and TLS inspection but is not “the WAF” for those HTTP(S) edge associations on AZ-500.
Deploying a standalone WAF virtual machine appliance in every subnet and ignoring Application Gateway and Front Door associations fails by concept: the exam skill centers on policy association to App Gateway or Front Door (and classic CDN), not arbitrary VM appliances. Attaching only Azure Firewall Premium IDPS as a replacement fails by concept: IDPS is not Application Gateway or Front Door WAF managed-rule policy. Putting both sites behind NSG HTTP allow rules and skipping WAF association fails by concept: NSGs lack OWASP managed-rule HTTP inspection.
Exam caveat: pick the WAF host to match regional Application Gateway versus global Front Door; do not rename Firewall IDPS as WAF. Operational check: associate WAF policies to the App Gateway WAF_v2 and Front Door profiles respectively, confirm policy mode and managed rules are active on each, and leave Firewall IDPS as a complementary—not substitute—control.