Microsoft Azure Security Engineer Associate AZ-500 Practice Question

In an Application Gateway WAF policy you can create a custom rule of type Match that evaluates the source IP address. Custom rules are processed before any managed rule sets, and evaluation stops as soon as a request matches a rule. Therefore, adding an Allow action custom rule that matches the on-premises CIDR range and assigning it a higher priority (lower numeric value) than every other custom rule ensures requests from that range are accepted without being inspected by the OWASP managed rules. Exclusion lists do not skip all inspections; they only remove specific fields from evaluation. Network Security Groups operate at the virtual-network layer, not inside the WAF pipeline. Switching the WAF mode to Detection would disable blocking for all traffic, which is not required.