Question

Your company runs a single Application Gateway (WAF_v2 SKU) that hosts three sites through separate listeners: a public marketing site, a partner portal, and an internal admin interface. Security requires that the admin interface run WAF in Prevention mode with the strictest OWASP rule set, the partner portal run in Prevention mode with several custom exclusions, and the marketing site remain in Detection mode temporarily while false positives are tuned. You must apply these different configurations with the least administrative overhead. What should you do?

Accepted Answer

Create three separate WAF policies and associate each policy at the per-listener (per-site) scope on the Application Gateway.

Answer

Create a single WAF policy at the gateway scope and use custom rules with match conditions on Host headers to vary the mode per site.

Answer

Deploy three separate Application Gateways, each with its own WAF policy, and split the listeners across them.

Answer

Associate one WAF policy at the gateway scope for Prevention mode and configure Detection mode overrides in the HTTP settings of the marketing listener.