Explanation:
Box 1: A custom rule
To rate limit incoming connections to Azure App Services using Azure Web Application Firewall (WAF) with Azure Front Door, you need to configure a custom WAF rule within your Front Door WAF policy. This rule will specify a rate limit threshold and a match condition that determines when the rate limiting should be applied.
Box 2: A managed rule set
Block attempts to access the apps from malicious bots.
To block malicious bots with Azure Web Application Firewall (WAF) on Azure Front Door and Azure App Service, you can enable bot protection rules within the WAF policy. Specifically, you'll want to enable the Bot Manager rule set, which helps identify and manage bot traffic, distinguishing between good bots and malicious ones.
Reference:
https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit
https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/afds-overview