Centralized protection for web applications against common exploits, such as SQL injection and cross-site scripting (XSS), with rules based on the OWASP Core Rule Set. It is deployed with Azure Application Gateway or Azure Front Door.
In SC-900 it is distinguished from Azure Firewall: WAF protects HTTP/HTTPS traffic to web apps (layer 7); Azure Firewall filters network traffic between networks and the internet. They are often used together as layers of defense in depth.
Azure Web Application Firewall (WAF) is a concept that can show up on the exam. Check the full guide to see it in context.