Question

Contoso hosts a public web application behind Azure Front Door Premium with an associated WAF policy. Compliance requires that all HTTP requests originating from outside Canada be blocked before reaching the origin, while requests from Canada continue to be evaluated by the managed rule sets. What should you configure in the Front Door WAF policy?

Accepted Answer

A custom rule that matches the RemoteAddr with a GeoMatch condition on country/region, using a 'not equals' operator for Canada, with the action set to Block

Answer

An NSG on the Front Door subnet with a deny rule for all source address prefixes except Canadian IP ranges

Answer

A managed rule set exclusion that removes non-Canadian traffic from evaluation

Answer

A rate limit custom rule scoped to the SocketAddr match variable filtered by GeoLocation