A team turns on a web application firewall for a new public site. It wants to record which requests would be blocked, without actually blocking anything, before enforcing rules. Which mode should it start with?
Show answer and explanation
Answer: B
Detection mode logs rule matches in the WAF logs but does not block requests. Teams use it to tune rules and find false positives before switching to prevention mode, which actively blocks matched traffic. Silent drop and redirect are not Azure WAF modes.
Why the other options are wrong
- A. Prevention mode blocks requests that match enabled rules. Starting there risks blocking legitimate traffic before the rules have been tuned.
- C. Azure WAF on Application Gateway has no silent drop mode. Blocking is set through prevention mode, while detection only logs matches.
- D. Redirect is not a WAF mode. WAF actions are logging or blocking, and redirecting requests is handled by routing rules rather than WAF mode.