StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · Application lifecycle workload identities and APIs

Practice question 440 of 498 · medium

A new Application Gateway WAF logs malicious requests but allows them through. It is running in detection mode. What is the correct interpretation?

Choose the single best answer.

  1. A.Detection mode can be used as proof the backend has no vulnerabilities
  2. B.This is expected; enforcement requires the intended prevention configuration
  3. C.Every logged managed-rule match automatically blocks even in detection mode
  4. D.Policy attachment alone guarantees every attack request is denied
Show the answer and explanation

✓ Correct answer

  • This is expected; enforcement requires the intended prevention configuration

Detection mode intentionally logs without blocking. Managed-rule matches do not override that mode. Policy attachment does not prove every route or request is enforced. Observation cannot prove absence of backend vulnerabilities.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.