# Challenge — Identify the failing layer without weakening protection

Start only after healthy validation and the live-calibrated WAF baseline pass. Use the same private run state. Preserve the €20 operating limit and begin cleanup by 4½ hours.

## Your assignment

You support a documentation site behind Application Gateway. One teammate treats every 502 as a stopped VM. Another wants to disable WAF whenever a legitimate request returns 403. Produce evidence that separates those assumptions.

1. Prove all baseline routes use trusted HTTPS and return this run's synthetic marker. Verify periodic backend health for every settings combination.
2. Inject the Probe fault. Identify the wrong probe path from its actual health reason. Show the exercise request failing while the control route succeeds. Repair the path, verify recovery, and repeat repair safely.
3. Inject the Tls fault. Prove that the backend can be reachable and its chain trusted while its expected hostname is wrong. Repair the expected name without disabling TLS validation.
4. Inject the Waf fault. Show the legitimate documentation request returning 403 and correlate it with actual contributing managed rules. Restore only the exact owned field/rule exclusion.
5. Prove the same attack-like fixture remains blocked in another parameter and the independent custom marker remains blocked. Explain that the labSnippet field/rule exclusion applies across all associated policy paths, not only /docs.
6. Prove final configuration consistency, clean up exact recorded resources, repeat cleanup, and export reviewed sanitized evidence.

## Evidence acceptance

| Claim | Minimum evidence |
|---|---|
| Healthy path | Real TLS-validated 200 response and correct run marker, plus periodic backend health |
| Probe incident | Missing-path health reason, exercise 502 and contemporaneous control 200 |
| TLS incident | Actual certificate/name diagnostic, exercise 502 and control 200 |
| WAF incident | Legitimate fixture 403 plus correlated managed-rule match/block rows |
| Narrow tuning | Exact RequestArgValues/Equals/labSnippet rule scope; legitimate request 200 and nonexcluded control 403 |
| Recovery | Fresh successful requests and safe repeated repair for each fault |
| Completion | No unexpected Terraform drift, exact resources absent after repeated cleanup, unrelated baseline unchanged |

A timeout, VM Agent failure or stopped IIS service is not interchangeable with an intended fault. Preserve all network, TLS and WAF boundaries throughout the exercise. Do not use an insecure TLS option, broad Allow rule, accepted 404 probe status, or public VM access to manufacture a pass.

Open HINTS.md one hint at a time. Consult SOLUTION.md after recording your own diagnosis.