Capabilities of Microsoft Security Solutions · Topic 1 of 5
Azure DDoS Protection, Firewall and WAF
SC-900 Azure network protection: DDoS Protection tiers, Azure Firewall with FQDN filtering and Firewall Manager, and Web Application Firewall against web attacks.
- 5 min
- DDoS Protection defends against traffic floods and has Network and IP tiers.
- Azure Firewall is a managed, stateful firewall with FQDN filtering and threat intelligence.
- Firewall Manager manages firewall policy centrally.
What it is
Three Azure services guard the edge of your network and your web applications. Azure DDoS Protection defends against floods of traffic meant to knock a service offline. Azure Firewall filters the traffic that enters and leaves your virtual networks. Azure Web Application Firewall (WAF) protects web applications from common attacks.
They sit at different points, and the exam asks which one fits a described threat.
How it works
Azure DDoS Protection
A distributed denial of service (DDoS) attack uses huge numbers of machines to flood a target with traffic until real users cannot get in. Azure provides basic protection for every resource by default. Azure DDoS Protection adds more, with two tiers.
| Tier | How it is applied |
|---|---|
| DDoS Network Protection | Covers the public IP addresses in a virtual network |
| DDoS IP Protection | Priced per protected public IP address, with the same core protection |
Both use adaptive tuning that learns your normal traffic, give telemetry and alerts, and have the Network tier include extras such as rapid response support and cost protection. DDoS Protection works at the network layer, for example against floods of packets, and does not read web requests.
Azure Firewall
Azure Firewall is a managed, cloud native firewall service. It is stateful, which means it tracks connections instead of judging each packet alone, and it scales automatically.
Its main abilities are:
- Network and application rules. Allow or deny traffic by address, port and protocol.
- FQDN filtering. Allow or deny traffic by destination domain name, such as only allowing outbound traffic to named websites.
- Threat intelligence filtering. Block traffic to and from known malicious addresses and domains.
- Central management. Azure Firewall Manager applies firewall policy across many firewalls and virtual networks from one place.
Azure Firewall comes in Basic, Standard and Premium tiers. Premium adds features such as TLS inspection and an intrusion detection and prevention system.
Azure Web Application Firewall (WAF)
A web application firewall inspects HTTP and HTTPS requests to a web application and blocks malicious ones. It defends against common attacks such as SQL injection and cross site scripting, using managed rule sets based on the OWASP list of top web risks. A WAF is attached to a service that handles web traffic, namely Azure Application Gateway and Azure Front Door.
It can run in detection mode, which logs suspicious requests, or prevention mode, which blocks them.
Choosing the right one
| The threat or need | Service |
|---|---|
| A flood of traffic that takes the site down | Azure DDoS Protection |
| Control outbound traffic by domain name | Azure Firewall |
| One place to manage rules across many virtual networks | Azure Firewall Manager |
| SQL injection in a web form | Azure Web Application Firewall |
| Block known malicious IP addresses | Azure Firewall threat intelligence |
A worked scenario
An online shop runs a website behind Azure Front Door. The company turns on a WAF in prevention mode, so SQL injection attempts in the checkout form are blocked. It enables DDoS Protection on the virtual network that hosts the back end, so a flood of traffic does not take the site down. A separate Azure Firewall controls the traffic leaving the virtual networks, with a rule that allows only the payment provider's domain name. Each service covers a different kind of attack.
How Azure Firewall rules are organised
Azure Firewall policy groups its rules into collections of three kinds.
| Rule type | What it does |
|---|---|
| DNAT rules | Translate an inbound address and port to an internal one, for example to publish a server |
| Network rules | Allow or deny by address, port and protocol |
| Application rules | Allow or deny by domain name, including web categories |
Rules are processed in a set order, and a policy can be shared by many firewalls through Firewall Manager.
WAF rules and modes
A WAF policy has managed rules, which are maintained by Microsoft and cover common attack patterns, and custom rules, which you write for your own needs, for example to block requests from a country or to rate limit one address. Start in detection mode to see what would be blocked, check for false alarms, and then switch to prevention mode.
Layers working together
| Layer | Service | Question it answers |
|---|---|---|
| Edge of the network | DDoS Protection | Is this a flood meant to overwhelm us? |
| Web requests | Web Application Firewall | Is this request trying to exploit the application? |
| Network traffic | Azure Firewall | Is this connection allowed between networks? |
| Subnets and interfaces | Network security groups | May this address reach this port? |
What to remember for the exam
- DDoS Protection defends against traffic floods and has Network and IP tiers.
- Azure Firewall is a managed, stateful firewall with FQDN filtering and threat intelligence.
- Firewall Manager manages firewall policy centrally.
- WAF protects web apps from attacks such as SQL injection and cross site scripting.
- WAF runs on Application Gateway and Front Door.
A WAF protects web applications at the HTTP level. It does not replace Azure Firewall, which filters network traffic, and neither stops a DDoS flood.
How the exam asks about this
- "Filter outbound HTTPS by domain name and manage rules in one place." Azure Firewall with Firewall Manager.
- "Protect a web form from SQL injection." Web Application Firewall.
- "Keep a public service online during a flood of requests." DDoS Protection.
- "Which firewall mode blocks the request rather than logging it?" Prevention mode.
Common mistakes
Using a WAF against a network flood. WAF reads web requests. DDoS Protection handles floods.
Expecting network security groups to filter by domain name. They cannot, and Azure Firewall can.
Thinking Azure Firewall is stateless. It is stateful.
Forgetting where a WAF runs. It is attached to Application Gateway or Front Door.
Check yourself
Which service protects against distributed denial of service attacks?
Azure DDoS Protection.
Which Azure service can filter outbound traffic by fully qualified domain name?
Azure Firewall.
What kinds of attack does a Web Application Firewall block?
Common web attacks such as SQL injection and cross site scripting.
Topic 1 of 5 in Capabilities of Microsoft Security Solutions
Test yourself on Capabilities of Microsoft Security Solutions
The full Microsoft SC-900 question bank has 503 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.