What's changed: Deepened AZ-500 Chapter 2 (ja figures; comparison tables/scenarios/FAQ/traps/deep paragraphs in all sections)
2.3Protecting Public Apps with WAF and DDoS
Understand Web Application Firewall (WAF) and DDoS Protection for public apps, plus private endpoints that keep service connectivity inside the VNet. These defend against L7 attacks and volumetric attacks.
Public web apps face application-layer (L7) attacks like SQL injection and XSS, and DDoS from flooding. WAF and DDoS Protection defend against these.
2.3.1WAF, DDoS, and private endpoints
To keep connectivity to PaaS private, use Azure Private Link. A private endpoint maps services like Storage or SQL to a private IP inside the VNet, keeping traffic off the public internet and within the Microsoft backbone—also mitigating data exfiltration.
- WAF: runs on Application Gateway / Front Door, blocking L7 attacks (SQL injection, XSS) via OWASP rules.
- DDoS Protection: absorbs and mitigates volumetric attacks from traffic floods.
- Private endpoint: keep connectivity to PaaS (Storage, SQL) on a private IP inside the VNet, avoiding the public path.
- Service endpoint: optimize the route to PaaS via the VNet and allow the VNet on the PaaS firewall (no private IP assigned).
Common on AZ-500: block L7 attacks like SQL injection/XSS = WAF (App Gateway/Front Door), mitigate volumetric attacks = DDoS Protection, keep PaaS connectivity on a private IP = private endpoint. Note the layers: NSG/Firewall at L3/L4, WAF at L7.
WAF offers Detection and Prevention modes. On rollout, start in Detection to check false positives, then switch to Prevention.
A WAF can sit on Application Gateway (regional) or Front Door (global edge), the latter blocking L7 attacks close to users worldwide. Rules combine managed rule sets (e.g., OWASP Core Rule Set, updated by Microsoft) with your own custom rules (geo-block, rate limiting, header matches). For DDoS, beyond the always-on Infrastructure protection you can choose DDoS Network Protection (per-VNet billing with detailed metrics, mitigation reports, and cost protection) or the finer-grained DDoS IP Protection (per protected public IP). For private connectivity, a private endpoint gives PaaS a private IP inside the VNet and cuts the public path, whereas a service endpoint only optimizes the route and allows the VNet on the PaaS firewall—no private IP is assigned.
| Item | Private endpoint | Service endpoint |
|---|---|---|
| Private IP | Assigns a VNet IP to the PaaS | Not assigned |
| Public path | Cut off (reach by IP) | Still via the PaaS public endpoint |
| From on-prem | Reachable via VPN/ER | No (VNet only) |
| Billing | Charged per endpoint | No extra charge |
Scenario: a global public app must block certain countries by region while defending against SQL injection. → Use a WAF on Front Door, block OWASP-class attacks via the managed rule set in Prevention mode, and geo-block target countries with custom rules. Lock backend Storage access behind a private endpoint.
FAQ: Q. WAF vs Azure Firewall? → A. A WAF specializes in HTTP/HTTPS (L7) app attacks; Azure Firewall is centralized L3–L7 network control. Q. Private endpoint vs service endpoint? → A. To fully cut the public path and reach it from on-prem, use a private endpoint; if VNet-only optimization suffices, a service endpoint adds no charge.
Trap: “a WAF stops volumetric DDoS” is wrong—a WAF handles L7 app attacks (SQLi/XSS); volumetric is DDoS Protection’s job. Also “a service endpoint assigns a private IP to the PaaS” is wrong—that’s a private endpoint.
2.3.2Section summary
- WAF = defend L7 attacks (App Gateway/Front Door), DDoS = mitigate volumetric
- Private endpoint = keep PaaS on a private IP
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. What protects public web apps from application-layer (L7) attacks like SQL injection and XSS?
Q2. You want PaaS (Storage, SQL) connectivity kept on a private IP inside the VNet, avoiding the public path. What do you use?
Q3. Which Azure capability mitigates volumetric attacks that flood a service to take it down?