AZ-700 Question 71
Single answerYour company hosts a web application on Azure that is frequently targeted by large-scale DDoS attacks. Management wants advanced DDoS protection and real-time notifications when an attack is detected. The application is hosted in a single virtual network containing an Azure Application Gateway with a public IP address. Which approach best meets these requirements for activating and monitoring distributed denial-of-service (DDoS) protection?
- A
Enable Azure DDoS Standard by creating a DDoS Protection Plan, associating it with the virtual network, and configuring Azure Monitor alerts for DDoS notifications.
- B
Enable DDoS logging in the Azure Application Gateway blade and set up an alert rule in Azure Monitor, without creating a DDoS Protection Plan.
- C
Create a DDoS Protection Plan in a different region and attach it directly to the public IP resource hosting the application.
- D
Rely on the default Azure DDoS Basic protection, which automatically mitigates all potential DDoS attacks without further configuration.
Show answer and explanation
Correct answer: A
Explanation
In Azure, DDoS Basic is automatically included but only provides basic protection without advanced monitoring or mitigation policies. To enable active monitoring, mitigation policies, and alerting, you must use Azure DDoS Standard. You do this by creating a DDoS Protection Plan within Azure, associating that plan with the relevant virtual network, and then leveraging Azure Monitor to configure alerts when DDoS mitigation is triggered. Refer to the official Microsoft documentation on �Azure DDoS Protection Standard� for detailed guidance on configuration and best practices (https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview).
- A. Correct.
Option 1 is correct. To leverage Azure DDoS Standard, you must create a DDoS Protection Plan in the same subscription, associate it with the virtual network containing the public IP resources, and then configure Azure Monitor alerts. This setup provides enhanced protection and real-time detection metrics.
- B. Incorrect.
Option 2 is incorrect. You cannot simply enable DDoS logging within the Application Gateway blade to achieve the advanced DDoS protection and real-time alerts. You must have an actual DDoS Standard Protection Plan associated with the virtual network to get the necessary telemetry and mitigations.
- C. Incorrect.
Option 3 is incorrect. The DDoS Protection Plan should be created in the same region and associated with the virtual network. Attaching it �directly to the public IP� is not the correct process; Azure DDoS Standard is enabled at the virtual network level through the DDoS Protection Plan.
- D. Incorrect.
Option 4 is incorrect. Azure DDoS Basic (enabled by default) provides some baseline protection, but it lacks the advanced monitoring, mitigation tuning, and alerting capabilities of DDoS Standard. Organizations requiring detailed telemetry and policy control should use DDoS Standard.