After enabling the WAF policy on Cascade Regional Airlines' Application Gateway in Prevention mode, the security team notices legitimate booking submissions from a partner travel agency are being blocked, and they need to understand what's triggering the block before re-enabling strict enforcement. What should they do first?

Detection mode on an Application Gateway WAF policy logs every rule match against the OWASP core rule set without blocking any request, which is precisely the visibility needed to identify a false positive — in this case, whichever managed rule is misidentifying the partner agency's booking payload as malicious — before re-enabling Prevention mode with a targeted exclusion or rule exception. Deleting the WAF policy entirely removes protection for every other client, not just the affected partner, and throws away the ability to diagnose the actual rule match. Increasing the backend pool size addresses capacity, not request filtering, and would do nothing to stop the WAF from blocking the same payload. Switching the load balancer's distribution mode is unrelated: Application Gateway's WAF operates at Layer 7 on HTTP(S) content inspection, while distribution mode is a Standard Load Balancer concept governing which backend VM a flow lands on. The exam-relevant caveat: Detection mode should be treated as a temporary diagnostic step, not a long-term posture, since it provides no actual blocking protection while active. Operationally, after switching modes, reproduce the partner's failing request and check the WAF logs in Azure Monitor or the firewall log for the specific rule ID that matched, then add a rule exclusion scoped to that field rather than disabling the rule set entirely.