AZ-500 Question 112
Single answerYou manage an online retail platform hosted in Azure, which experiences periodic traffic surges on its public-facing endpoints, sometimes affecting availability. You want consistent, advanced protection against large-scale volumetric attacks and protocol-based threats, along with real-time telemetry and alerts. Which approach should you recommend to best protect against DDoS attacks?
- A
Rely on the default DDoS Protection Basic included with Azure services
- B
Upgrade the virtual network containing the public endpoints to Azure DDoS Protection Standard
- C
Deploy an Azure Firewall to filter all ingress traffic at the network perimeter
- D
Rely solely on a Web Application Firewall (WAF) for complete DDoS mitigation
Show answer and explanation
Correct answer: B
Explanation
Azure DDoS Protection Standard is specifically designed to defend against volumetric and protocol-based attacks at the network layer. It also provides additional features such as cost protection and detailed attack analytics. For more details, refer to Microsoft’s official documentation: https://docs.microsoft.com/azure/virtual-network/ddos-protection-overview.
- A. Incorrect.
Option 1: Incorrect. The built-in DDoS Protection Basic provides limited protection and does not offer real-time telemetry, cost protection, or elevated mitigations for sophisticated volumetric attacks.
- B. Correct.
Option 2: Correct. Azure DDoS Protection Standard offers enhanced and adaptive DDoS mitigation tuned specifically for Azure assets, including real-time metrics, alerts, and cost protection, making it ideal for mission-critical workloads exposed to the public internet.
- C. Incorrect.
Option 3: Incorrect. While Azure Firewall provides security for traffic filtering, it is not a dedicated DDoS protection service, and volumetric or protocol attacks can still overwhelm network throughput if not mitigated by Azure DDoS Protection Standard.
- D. Incorrect.
Option 4: Incorrect. A Web Application Firewall (WAF) primarily protects against application-layer (Layer 7) threats. It does not provide the same level of network-layer volumetric or protocol-based DDoS mitigation as Azure DDoS Protection Standard.