The AZ-500 exam has been retired
It was retired on August 31, 2026. It was replaced by SC-500 (Microsoft Cloud and AI Security Engineer). Go to the SC-500 study guide →
Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.
3.4.2. Azure Application Gateway and WAF
💡 First Principle: Application Gateway is a Layer 7 (application layer) load balancer. Web Application Firewall (WAF) protects against common web exploits like SQL injection and cross-site scripting.
Scenario: You have web applications that need load balancing, SSL offloading, and protection against OWASP Top 10 vulnerabilities.
Application Gateway Capabilities
| Feature | Description |
|---|---|
| SSL termination | Offload SSL processing from backend servers |
| URL-based routing | Route /api/* to API servers, /web/* to web servers |
| Host header routing | Route based on domain name |
| WAF | Protection against web attacks |
| Autoscaling | Scale based on traffic |
⚠️ Exam Trap: Deploying Application Gateway thinking it provides DDoS protection. WAF protects against application-layer attacks (OWASP), not volumetric DDoS attacks. Use DDoS Protection Standard for DDoS mitigation.
Enroll to unlock the 4 practice questions written for this section, so you can test what you just read while it is fresh.
Enroll to unlock the 4 flashcards for this section and review them on a spaced-repetition schedule.
Written byAlvin Varughese
Founder•20 professional certifications