Question

Your company hosts a public API behind Azure Front Door Premium with a WAF policy in Prevention mode. During a promotional event, a small number of client IP addresses generate an abnormally high volume of requests, degrading performance for legitimate users. You must automatically block any single client IP that exceeds 1,000 requests within a 1-minute window, while leaving all other traffic unaffected. What should you configure in the WAF policy?

Accepted Answer

A custom rule of type RateLimitRule with a rate limit threshold of 1000, a 1-minute duration, and a match condition grouping by the client IP address

Answer

A managed rule set exclusion that suppresses the DDoS-related managed rules for the affected client IPs

Answer

A custom rule of type MatchRule that blocks the RemoteAddr values matching the offending client IPs

Answer

Enable Azure DDoS Network Protection on the Front Door endpoint and set a per-IP connection limit of 1000