StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · Application lifecycle workload identities and APIs

Practice question 444 of 498 · hard

A WAF must be moved from observation to production enforcement. Which two activities support a safe transition? Select two.

Select all that apply. Every correct option and no extras are required for credit in the app.

  1. A.Enable the intended prevention behavior and validate both legitimate and attack requests
  2. B.Treat a successful portal save as proof that all application routes are protected
  3. C.Review representative logs and investigate false positives before narrowly justified tuning
  4. D.Add a broad allow rule for all authenticated users to skip inspection
  5. E.Disable diagnostics so the deployment appears quiet
Show the answer and explanation

✓ Correct answers

  • Enable the intended prevention behavior and validate both legitimate and attack requests
  • Review representative logs and investigate false positives before narrowly justified tuning

Log-based tuning and practical enforcement tests validate the change. Authenticated users can still attack, disabling diagnostics removes evidence, and saving policy does not prove route coverage or runtime behavior.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.