AZ-500 Question 113
Single answerContoso is preparing to launch a new global e-commerce platform hosted in Azure. The platform includes multiple web apps and APIs running in a virtual network and exposed via public IP addresses. The business requires comprehensive protection against large-scale volumetric attacks, as well as cost protection and advanced telemetry. Which approach should you recommend to meet these requirements?
- A
Rely on the built-in DDoS Basic protection enabled by default on all Azure services
- B
Enable Azure DDoS Protection Standard on the virtual network hosting the public endpoints
- C
Deploy Azure Firewall to handle all traffic filtering exclusively
- D
Use only Azure Web Application Firewall (WAF) on an Application Gateway
Show answer and explanation
Correct answer: B
Explanation
Azure DDoS Protection Standard is designed to provide enhanced mitigation for volumetric and protocol-based attacks at Layers 3 and 4, along with additional features like fast detection, cost protection, and telemetry beyond the default protection. For workloads exposing public endpoints on Azure, particularly mission-critical or high-traffic applications, enabling Azure DDoS Protection Standard on the virtual network is the recommended approach. Refer to Microsoft documentation for more details: https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview
- A. Incorrect.
Option 1 is incorrect. DDoS Protection Basic provides baseline protection at the platform level, but it does not include the advanced mitigation policies, cost protection, and real-time monitoring/alerts provided by DDoS Protection Standard.
- B. Correct.
Option 2 is correct. Azure DDoS Protection Standard provides advanced mitigation capabilities, cost protection, and rich telemetry. It is generally recommended for high-value or mission-critical workloads exposed to the public internet to counter large-scale DDoS attacks more effectively.
- C. Incorrect.
Option 3 is incorrect. Azure Firewall filters network traffic but does not provide specialized, adaptive DDoS mitigation. DDoS attacks can still exhaust resources without the advanced mitigations of DDoS Protection Standard.
- D. Incorrect.
Option 4 is incorrect. While Azure WAF protects against application-layer attacks (Layer 7), it does not address volumetric DDoS (Layer 3/4) activities in the same depth as Azure DDoS Protection Standard.