Application Gateway & WAF
Layer 7 regional load balancing with URL and host routing, TLS termination and an optional web application firewall.
Readiness
0%
2h 20m baseline
Exam memorization points
- Application Gateway is layer 7 and supports path-based and host-based (multi-site) routing.
- It requires its own dedicated subnet, and nothing else may be deployed in that subnet.
- SKU families are Standard v2 and WAF v2; WAF adds OWASP core rule sets with Detection and Prevention modes.
- Listeners define the frontend (basic or multi-site); rules bind listeners to backend pools and HTTP settings.
- Backend HTTP settings control the port, protocol, cookie-based affinity, connection draining and the custom probe.
- Autoscaling v2 has a minimum and maximum instance count, and capacity planning assumes a /24 subnet for the largest scale.
Traps & distractors
- Deploying anything else into the Application Gateway subnet, which blocks the gateway.
- Running WAF in Detection mode and expecting attacks to be blocked. Only Prevention blocks.
- Forgetting that health probes use the backend HTTP settings path unless you define a custom probe.
- Expecting Application Gateway to be global. It is regional; global HTTP entry points use Azure Front Door.
- Assuming the backend hostname and SNI settings are optional when the backend serves multiple TLS sites.
Suggested lab
Path-based routing behind a WAF
Configure L7 routing and prove the WAF blocks a malicious request.
- 1Create a /24 subnet and deploy a WAF_v2 Application Gateway with a public frontend.
- 2Create two backend pools served by two web apps, plus a custom probe on /health.
- 3Add listeners and a path-based rule sending /api/* to one pool and /* to the other.
- 4Enable the OWASP rule set in Prevention mode and send a SQL injection style request, capturing the blocked response.
- 5Inspect the WAF logs in Log Analytics and identify the matched rule.
Microsoft Learn
- What is Azure Application Gateway?doc
- Search Microsoft Learn: Application Gateway v2 WAF mode path-based routing backend settingssearch
Live Microsoft Learn ingestion is a Sprint 2 item; until then links are curated and the search fallback always resolves.
Status
No time invested yet. Baseline assumptions only.
Self-assessed mastery
0%
High priority
Strong exam value. Schedule this week.
- Exam importance100% × 30% = 30.0
Learner-agnostic frequency on the real exam (5/5).
- Blueprint weight78% × 25% = 19.4
This topic's domain carries 17.5% of the exam objectives.
- Dependency leverage0% × 20% = 0.0
Nothing else in the graph depends on this topic.
- Current gap100% × 25% = 25.0
Readiness is 0%, so 100% of the topic is still uncovered.
Exam Priority Score = 30% importance + 25% blueprint + 20% dependency + 25% gap. Importance is exam frequency, blueprint is the domain's official exam weight, dependency is how many later topics this one unlocks, and gap is how far you currently are from ready.
Unlocks next
Leaf topic - nothing depends on it.
Baseline study time
2h 20m
Complexity
4 / 5
Remaining to target
1h 59m
Status weight
0%
Topics: application gateway, waf, l7, path-based routing, listener, tls, agIC
Weak neighbours in Networking