You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: learn-pr/aspnetcore/build-web-api-minimal-api/includes/2-what-is-minimal-api.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -146,6 +146,7 @@ To use Swagger and the Swagger UI in your API, you do two things:
146
146
{
147
147
c.SwaggerDoc("v1", new OpenApiInfo { Title = "Todo API", Description = "Keep track of your tasks", Version = "v1" });
148
148
});
149
+
}
149
150
```
150
151
151
152
- Add `UseSwagger()` and `UseSwaggerUI()`. These two code lines tell the API project to use Swagger and also where to find the specification file *swagger.json*.
- content: "Suppose a company wants to stop threat actors from submitting malicious requests to a web app. Which of the following Azure Web Application Firewall modes should the company use?"
18
-
choices:
19
-
- content: "Detection"
20
-
isCorrect: false
21
-
explanation: "Incorrect. Detection mode only logs a rule violation. It doesn't stop a request from being submitted."
22
-
- content: "Prevention"
23
-
isCorrect: true
24
-
explanation: "Correct. Prevention mode not only logs a rule violation, but it also stops the request from being submitted to the web app."
25
-
- content: "Exclusions"
26
-
isCorrect: false
27
-
explanation: "Incorrect. Exclusions are an Azure Web Application Firewall feature that enables you to ignore specified HTTP/HTTPS request attributes."
28
-
- content: "Suppose a company wants to deploy Azure Web Application Firewall to protect a web application that accepts user data from a form. Which of the following best describes how Azure Web Application Firewall protects the app?"
29
-
choices:
30
-
- content: "Custom rules"
31
-
isCorrect: false
32
-
explanation: "Incorrect. A custom rule is a user-defined firewall rule that helps protect an app from a threat not covered by the managed rules offered by Azure Web Application Firewall."
33
-
- content: "Remote file inclusion"
34
-
isCorrect: false
35
-
explanation: "Incorrect. Remote file inclusion is an exploit where an attacker sends the server specially configured text that passes a remote file to a script's `include` statement."
36
-
- content: "Sanitizing input"
37
-
isCorrect: true
38
-
explanation: "Correct. Sanitizing input refers to removing or disabling dangerous text elements of user-generated input."
39
-
- content: "Suppose a company wants to deploy a web app and is trying to decide whether to use in-house developers to code against common exploits. Which of the following scenarios isn't an argument in favor of using Azure Web Application Firewall?"
40
-
choices:
41
-
- content: "Your web app includes user accounts and stores sensitive or proprietary data."
42
-
isCorrect: false
43
-
explanation: "Incorrect. User credentials, sensitive personal information, and proprietary company data are coveted by malicious users, so Azure Web Application Firewall is a good choice for protecting that data."
44
-
- content: "Your web app is made available to employees, customers, and vendors using a private network connection."
45
-
isCorrect: true
46
-
explanation: "Correct. Private access to the virtual network where the web app resides means that app traffic never goes over the public internet. There is no need to protect the app against common web exploits."
47
-
- content: "Your web app development team lacks security expertise, time, and money."
48
-
isCorrect: false
49
-
explanation: "Incorrect. A lack of expertise, time, and money can prevent your team from covering all possible exploits, which can leave your app vulnerable. Azure Web Application Firewall protects against all OWASP exploits and can be deployed quickly and cost-effectively."
- content: "Suppose a company wants to stop threat actors from submitting malicious requests to a web app. Which of the following Azure Web Application Firewall modes should the company use?"
18
+
choices:
19
+
- content: "Detection"
20
+
isCorrect: false
21
+
explanation: "Incorrect. Detection mode only logs a rule violation. It doesn't stop a request from being submitted."
22
+
- content: "Prevention"
23
+
isCorrect: true
24
+
explanation: "Correct. Prevention mode not only logs a rule violation, but it also stops the request from being submitted to the web app."
25
+
- content: "Exclusions"
26
+
isCorrect: false
27
+
explanation: "Incorrect. Exclusions are an Azure Web Application Firewall feature that enables you to ignore specified HTTP/HTTPS request attributes."
28
+
- content: "Suppose a company wants to deploy Azure Web Application Firewall to protect a web application that accepts user data from a form. Which of the following best describes how Azure Web Application Firewall protects the app?"
29
+
choices:
30
+
- content: "Custom rules"
31
+
isCorrect: false
32
+
explanation: "Incorrect. A custom rule is a user-defined firewall rule that helps protect an app from a threat not covered by the managed rules offered by Azure Web Application Firewall."
33
+
- content: "Remote file inclusion"
34
+
isCorrect: false
35
+
explanation: "Incorrect. Remote file inclusion is an exploit where an attacker sends the server specially configured text that passes a remote file to a script's `include` statement."
36
+
- content: "Sanitizing input"
37
+
isCorrect: true
38
+
explanation: "Correct. Sanitizing input refers to removing or disabling dangerous text elements of user-generated input."
39
+
- content: "Suppose a company wants to deploy a web app and is trying to decide whether to use in-house developers to code against common exploits. Which of the following scenarios isn't an argument in favor of using Azure Web Application Firewall?"
40
+
choices:
41
+
- content: "Your web app includes user accounts and stores sensitive or proprietary data."
42
+
isCorrect: false
43
+
explanation: "Incorrect. Malicious users covet user credentials, sensitive personal information, and proprietary company data. Azure Web Application Firewall is a good choice for protecting that data."
44
+
- content: "Your web app is made available to employees, customers, and vendors using a private network connection."
45
+
isCorrect: true
46
+
explanation: "Correct. Private access to the virtual network where the web app resides means that app traffic never goes over the public internet. There's no need to protect the app against common web exploits."
47
+
- content: "Your web app development team lacks security expertise, time, and money."
48
+
isCorrect: false
49
+
explanation: "Incorrect. A lack of expertise, time, and money can prevent your team from covering all possible exploits, which can leave your app vulnerable. Azure Web Application Firewall protects against all OWASP exploits and can be deployed quickly and cost-effectively."
Copy file name to clipboardExpand all lines: learn-pr/azure-networking/introduction-azure-web-application-firewall/includes/1-introduction.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,12 +1,12 @@
1
-
Azure Web Application Firewall is an Azure service that protects web applications from common attacks such as SQL injection and cross-site scripting. The protection extends beyond OWASP (Open Worldwide Application Security Project) top 10 attacks. It can also detect malicious bot attacks, API attacks, and application layer DDoS attacks.
1
+
Azure Web Application Firewall is an Azure service that protects web applications from common attacks such as SQL injection and cross-site scripting. The protection extends beyond OWASP (Open Worldwide Application Security Project) top 10 attacks. It can also detect malicious bot attacks, API attacks, and application layer DDoS attacks.
2
2
3
3
Suppose you work for Contoso, Ltd., a financial-services company in Seattle with major offices located throughout the world. Contoso's compute environment runs as Azure virtual network resources. These resources include several existing and planned web applications that serve customers, vendors, and employees.
4
4
5
5
The Contoso IT staff is concerned that their web applications are the target of malicious attacks using common exploits such as SQL injection. IT wants to protect their apps. However, their web development team lacks the expertise, time, and budget to write the necessary protection code.
6
6
7
7
Suppose you're a senior Contoso web developer. You're responsible for researching and recommending a way to protect Contoso's web applications. You've been asked to evaluate whether Azure Web Application Firewall can protect your web apps from attacks that use common exploits.
8
8
9
-
In this module, you learn the basics of Azure Web Application Firewall. Those basics consist of what it is, how it works, and when you should use it. By the end of this module, you'll have the knowledge needed evaluate whether Azure Web Application Firewall can protect Contoso's web apps from common attacks.
9
+
In this module, you learn the basics of Azure Web Application Firewall. Those basics consist of what it is, how it works, and when you should use it. By the end of this module, you'll have the knowledge needed to evaluate whether Azure Web Application Firewall can protect Contoso's web apps from common attacks.
Copy file name to clipboardExpand all lines: learn-pr/azure-networking/introduction-azure-web-application-firewall/includes/2-what-is-azure-web-application-firewall.md
+4-5Lines changed: 4 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -26,19 +26,18 @@ You can deploy Azure Web Application Firewall in minutes. Your web apps immediat
26
26
27
27
To help you evaluate Azure Web Application Firewall, here are some of its important features:
28
28
29
-
-**Managed rules**: The rules that Azure Web Application Firewall uses to detect and prevent common exploits are created, maintained, and updated by Microsoft's security team. If a rule changes, or a rule set (refer to the following description) is modified, Microsoft updates Azure Web Application Firewall automatically and seamlessly.
29
+
-**Managed rules**: Microsoft's security team creates, maintains, and updates the rules that Azure Web Application Firewall uses to detect and prevent common exploits. If a rule changes, or a rule set (refer to the following description) is modified, Microsoft updates Azure Web Application Firewall automatically and seamlessly.
30
30
31
31
> [!NOTE]
32
-
> You can't modify or delete the managed rules offered by Azure Web Application Firewall. However, if a particular rule is problematic for your environment (for example, it blocks legitimate traffic to your web app) you can create exclusions or disable the rule, or rule set. You can also create custom rules to overwrite the default behavior.
32
+
> You can't modify or delete the managed rules offered by Azure Web Application Firewall. However, if a particular rule is problematic for your environment (for example, it blocks legitimate traffic to your web app) you can create exclusions or disable the rule or rule set. You can also create custom rules to overwrite the default behavior.
33
33
34
34
-**Bot rules**: The bot rules identify good bots and protect from bad bots. Bad bots are detected based on Microsoft Threat Intelligence.
35
-
36
35
-**Custom rules**: If the managed rules offered by Azure Web Application Firewall don't cover a specific threat to your web application, you can create a custom rule.
37
-
-**Modes**: Azure Web Application Firewall can operate in one of two modes: detection mode only logs requests that violate a rule, while prevention mode both logs and blocks requests that violate a rule.
36
+
-**Modes**: Azure Web Application Firewall can operate in one of two modes. Detection mode only logs requests that violate a rule, while prevention mode both logs and blocks requests that violate a rule.
38
37
-**Exclusion lists**: You can configure Azure Web Application Firewall to ignore specific attributes when it checks requests.
39
38
-**Policies**: You can combine a set of managed rules, custom rules, exclusions, and other Azure Web Application Firewall settings into a single element called an Azure Web Application Firewall policy. You can then apply that policy to multiple web apps for easy management and maintenance.
40
39
-**Request size limits**: You can configure Azure Web Application Firewall to flag requests that are either too small or too large.
41
-
-**Alerts**: Azure Web Application Firewall integrates with Azure Monitor. This integration gives you near-real-time alerts when the WAF detects a threat.
40
+
-**Alerts**: Azure Web Application Firewall integrates with Azure Monitor. This integration gives you near-real-time alerts when the WAF (Web Application Firewall) detects a threat.
42
41
43
42
## Common attacks prevented by Azure Web Application Firewall
0 commit comments