Question

A retail company runs a public e-commerce web application behind Azure Front Door. Security has observed credential-stuffing attempts, automated scraping of product pricing, and occasional SQL injection payloads against the login and search endpoints. The architect must design a WAF policy that blocks known web exploits, mitigates malicious automated traffic, and allows verified search-engine crawlers to continue indexing the catalog, while minimizing false positives against legitimate shoppers. Which WAF configuration best meets these requirements?

Accepted Answer

Deploy the Azure Front Door WAF in Prevention mode with the Microsoft Default Rule Set (DRS) plus the Bot Manager ruleset, tuning per-rule exclusions and rate limiting after monitoring in Detection mode.

Answer

Deploy an Application Gateway WAF v2 in Detection mode only with the OWASP CRS, and rely on Network Security Groups to block scraping IP ranges.

Answer

Enable Azure DDoS Network Protection on the Front Door public IP and create custom geo-filtering rules to block all traffic outside the primary sales region.

Answer

Configure a Front Door WAF custom rule that blocks any request whose User-Agent contains the word 'bot', and disable the managed rule sets to avoid false positives.