AZ-500 Question 114
Select 2Contoso runs a mission-critical online storefront in Azure using multiple public IP addresses for its web front ends. They want to minimize downtime from large-scale volumetric attacks and are considering upgrading to Azure DDoS Protection Standard. In which two of the following situations would it be recommended to implement Azure DDoS Protection Standard?
- A
You require advanced mitigation policies and cost protection against large-scale volumetric DDoS attacks.
- B
Your application is only accessed via private endpoints within the same virtual network and does not expose any public IP addresses.
- C
You need enhanced telemetry, logging, and attack analytics to quickly respond to potential DDoS threats.
- D
You only need to filter and inspect application-layer (Layer 7) traffic using a Web Application Firewall (WAF).
Show answer and explanation
Correct answers: A, C
Explanation
Azure DDoS Protection Standard is designed for scenarios where there is a high risk of volumetric (Layer 3 and Layer 4) DDoS attacks on publicly exposed endpoints. In addition to the basic DDoS protection included in Azure, the standard tier offers advanced mitigation policies, enhanced telemetry, cost protection for related scale-out expenses during an attack, and real-time monitoring. For more details, refer to Microsoft documentation on Azure DDoS Protection Standard at https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview.
- A. Correct.
Correct. Azure DDoS Protection Standard is recommended when you need advanced capabilities to mitigate high-volume network attacks. It also provides cost protection for resource scaling caused by DDoS attacks.
- B. Incorrect.
Incorrect. If your resources are isolated to private endpoints only, the default DDoS protection included in Azure is typically sufficient. Azure DDoS Protection Standard is most beneficial for public-facing endpoints.
- C. Correct.
Correct. Azure DDoS Protection Standard provides detailed telemetry, near real-time monitoring, and attack analytics to help you identify and respond to DDoS incidents faster.
- D. Incorrect.
Incorrect. A WAF mainly focuses on Layer 7 threats (e.g., SQL injection, cross-site scripting). While it is complementary to DDoS Standard, it doesn’t cover volumetric attacks that target Layer 3 and Layer 4. Azure DDoS Protection Standard is specifically designed to mitigate those network layer attacks.