Delta E-Commerce uses Application Gateway v2 with WAF_v2 to protect checkout endpoints. They observe false positives from the OWASP CRS 3.2 SQLi rule for a legitimate JSON payload that contains '=' and 'or' strings. They want to keep the global OWASP rule set active but exclude the specific rule for the /api/checkout path without disabling the rule globally. What configuration will accomplish this?

The correct option allows for granular control by creating a WAF custom exclusion. This targets the specific rule (SQLi) and the specific path (/api/checkout) where false positives occur, without compromising protection for other rules or paths. It uses requestBody inspection to focus on the problematic payload. Disabling the rule globally would remove protection for all endpoints, which is not desired. Deploying a separate Application Gateway adds complexity and cost, and bypasses WAF protection entirely for that path. Lowering the WAF policy to 'Detection' mode would only log the detections, not block them, leaving the application vulnerable and requiring manual intervention for every alert.