4.1.3. Azure Web Application Firewall (WAF)
💡 First Principle: Web Application Firewall protects specifically at Layer 7 (the application layer) against attacks that exploit how web applications process input — like SQL injection and cross-site scripting — which lower-layer controls like NSGs and even Azure Firewall's network rules are not designed to inspect.
WAF typically deploys alongside Azure Application Gateway or Azure Front Door, inspecting incoming HTTP/HTTPS requests against rule sets aligned to the OWASP Top 10 web vulnerabilities before those requests ever reach your application code.
⚠️ Exam Trap: A scenario describing SQL injection or cross-site scripting protection is testing WAF specifically — NSGs and Azure Firewall's network-layer rules do not inspect the content of a web request the way WAF does.
Reflection Question: A company's public-facing web app is being probed with SQL injection attempts. Would adding NSG rules address this? What's the right tool instead, and why?
