Question

A financial services company is designing an internet-facing API on Azure that must meet a stringent Well-Architected Framework review. During peak trading hours the API scales to thousands of instances behind Azure Front Door. The security team requires TLS inspection and Web Application Firewall (WAF) protection, but the platform team warns that adding inline inspection at each backend instance would create latency and CPU overhead that harms the Performance Efficiency pillar. As the cybersecurity architect, what is the best design approach that aligns security controls with WAF pillar trade-offs?

Accepted Answer

Enable the Azure Front Door WAF policy in Prevention mode at the edge so inspection is centralized and offloaded from backend instances, and scale the backend independently on application logic.

Answer

Deploy a WAF sidecar container on every backend instance so each scaled instance independently inspects its own traffic and reduces reliance on a shared control point.

Answer

Disable TLS inspection during peak trading hours and re-enable it during off-peak windows to preserve Performance Efficiency when load is highest.

Answer

Route all traffic through a single high-capacity network virtual appliance in a hub VNet and vertically scale that appliance to handle peak inspection demand.