# Knowledge check — Application Gateway WAF on Windows IIS

Choose one best answer before opening its explanation. These original questions test the workshop's reasoning; they are not Microsoft exam questions. Practical completion still requires baseline, three observed fault/recovery cycles and verified cleanup. With eight questions, 0–5 correct means repeat the mapped blocks, 6 means targeted review, and 7–8 means move forward once the practical work is complete.

## 1. One VM, two different health results

The control route returns 200. The probe-exercise route returns 502, and its periodic health reason shows an unexpected missing-file response. Both target the same VM. What should you inspect first?

A. Whether every backend route needs its own VM.

B. The exercise probe path and its accepted response status.

C. The frontend certificate expiration, because every 502 is a TLS problem.

D. The WAF exclusion, because WAF always generates 502.

**Answer: B.** Health is evaluated for a backend server/settings combination. A wrong probe path can make one combination unhealthy while another succeeds. A is unnecessary; C ignores the actual health reason; D confuses an unhealthy-backend response with a WAF decision. **Review:** Block 5.

## 2. Trusted certificate, wrong name

The backend certificate chain is trusted, but the exercise settings expect wrong.lab.test and the leaf SAN contains backend.lab.test. Which repair preserves the intended boundary?

A. Turn off hostname and chain validation.

B. Add 502 to accepted health statuses.

C. Restore backend.lab.test as the expected hostname and keep TLS validation enabled.

D. Give the VM a public IP so the gateway can bypass its private path.

**Answer: C.** Trust and identity are separate checks. The expected hostname must match the certificate. A weakens TLS; B does not repair a failed TLS handshake; D changes exposure without correcting the name. **Review:** Block 6.

## 3. Which 403 proves the managed-rule fault?

The custom marker labMarker=awz-block-me returns 403. What additional evidence is needed for the legitimate documentation fixture's managed-rule exercise?

A. The marker denial is sufficient because every WAF 403 uses the same rule.

B. A screenshot showing that the VM is running.

C. Any old SQL-injection rule ID from another ruleset version.

D. The fixture's actual blocked request and correlated managed-rule contributors in this run's logs.

**Answer: D.** The custom marker is a separate deterministic enforcement control. A conflates custom and managed rules; B says nothing about the decision; C is not evidence for the pinned catalog. **Review:** Blocks 4 and 7.

## 4. A legitimate snippet needs an exclusion

The known-safe labSnippet value matches several managed rules. Which tuning is narrowest for this exercise?

A. Exclude RequestArgValues Equals labSnippet only for the actual contributing rule IDs.

B. Disable all XSS rules globally.

C. Add a custom Allow rule for every request to the site.

D. Exclude all query-string values from all rules.

**Answer: A.** It scopes the change to a known field and observed contributors, across every path using the gateway-associated policy. It is not limited to /docs. B changes protection for every field; C stops later enforcement; D removes broad request inspection. The static documentation endpoint never executes or reflects the snippet. **Review:** Block 7.

## 5. What proves narrow repair?

After restoring the exclusion, the legitimate labSnippet request returns 200. Which next check best establishes that the same rule protection remains elsewhere?

A. Check only the deployment's provisioning state.

B. Send the same pattern through the nonexcluded untrustedSnippet parameter and require the expected block.

C. Send the identical request again from a cached response.

D. Remove Prevention mode so successful requests are easier to obtain.

**Answer: B.** The nonexcluded field is a boundary control. A checks configuration lifecycle; C can conceal current behavior; D changes the intended enforcement state. **Review:** Block 7.

## 6. The log table has no rows yet

The HTTP test completed, but the resource-specific firewall table is absent or empty. What is the appropriate next step?

A. Copy illustrative output into the evidence report.

B. Mark the log test passed because ingestion is asynchronous.

C. Verify diagnostics and destination, generate a fresh marked request, and poll within the bounded wait.

D. Switch the KQL query to random legacy field names until it returns a row.

**Answer: C.** Ingestion latency is a reason to wait and inspect, not to invent success. A fabricates evidence; B lacks the required observation; D can query unrelated data or the wrong schema. **Review:** Block 7 and queries/.

## 7. Autoscale minimum is zero

The gateway has autoscale minimum zero and currently serves little traffic. Which cost statement is accurate?

A. The gateway is free until a backend receives a request.

B. Stopping the Windows VM removes all charges.

C. The €20 operating limit is an Azure-enforced spending cap.

D. The fixed gateway charge remains, and other provisioned resources can continue charging until cleanup.

**Answer: D.** Minimum zero does not remove the fixed charge. A and B omit provisioned services; C confuses local operational checks with billing enforcement. **Review:** Block 2.

## 8. Azure accepted the deletion

The delete command exits successfully, but the group still reports Deleting. What establishes completion?

A. Retain the exact ledger, wait for confirmed resource absence, repeat cleanup and compare the protected baseline.

B. Delete the local state immediately because the request succeeded.

C. Search by a similar prefix and delete every matching resource.

D. Publish raw state and credentials so another learner can confirm the deletion.

**Answer: A.** Acceptance is an observation of absence, followed by repeat safety and preservation checks. B discards recovery information; C broadens scope beyond ownership; D exposes private runtime material. **Review:** Block 8.