GreenCloud wants to block a small set of malicious IP addresses and also limit abusive clients by rate on their WAF policy for an Application Gateway v2. They also want to block requests coming from certain countries. Which combination of custom WAF rules should they implement to meet rate limiting, IP blocklist, and geo-filtering requirements efficiently?

This option correctly leverages the capabilities of Azure Application Gateway WAF v2. Custom WAF rules allow for specific actions based on different match conditions. An IPMatch rule is ideal for blocking specific malicious IPs. A RateLimit custom rule directly addresses the need for client-side rate limiting, using X-Forwarded-For to identify individual clients behind proxies. A GeoMatch rule is designed for blocking traffic from specific countries. Assigning different priorities ensures the rules are evaluated in the desired order (e.g., blocking known malicious IPs first). The other options are incorrect because: A single IPMatch rule cannot include country CIDR blocks directly; GeoMatch is required. Global rate limits in Application Gateway settings are not granular per client IP. Custom Request Body rules are not designed for efficient rate limiting, and Network Security Groups (NSGs) operate at the network layer, not the application layer, making them less suitable for fine-grained WAF-specific geo-blocking or client-IP rate limiting. Relying on Azure Front Door would mean moving the WAF functionality, which is not what the question implies for the Application Gateway WAF. The question asks how to implement these requirements on their WAF policy for an Application Gateway v2.