Azure DDoS Protection: AZ-500 Exam Essentials
Azure DDoS Protection Standard adds adaptive tuning, attack analytics, and cost guarantees over the free Basic tier. Know the SKU differences, what protection covers, and what it does not: the exam tests both.
Basic vs Standard (Network Protection)
| Feature | Basic (free) | Standard / Network Protection |
|---|---|---|
| Always-on traffic monitoring | Yes | Yes |
| Automatic attack mitigation | Yes | Yes |
| Adaptive tuning | No | Yes |
| Attack analytics and metrics | No | Yes |
| Cost protection guarantee | No | Yes |
| Rapid Response support | No | Yes |
Adaptive Tuning
Standard/Network Protection learns the normal traffic pattern for each protected public IP and dynamically adjusts mitigation thresholds. Basic uses static thresholds: it can block legitimate traffic spikes or miss low-volume volumetric attacks.
What DDoS Protection Covers
DDoS Protection Standard protects:
- Public IP addresses (Azure Public IP resource type)
- Virtual machine NICs with public IPs
- Application Gateway (if it has a public frontend IP)
- Azure Firewall public IP
IP Protection SKU
In 2023 Azure added "IP Protection": a per-IP SKU cheaper than enabling Network Protection on an entire VNet. The exam tests when IP Protection is sufficient: the answer is when you have a small number of public IPs and do not need VNet-wide coverage.
Attack Metrics and Alerts
Standard exposes metrics in Azure Monitor: IfUnderDDoSAttack, BytesDroppedDDoS, PacketsDroppedDDoS. Configure an alert rule on IfUnderDDoSAttack == 1 to notify the SOC when mitigation is active.
Get weekly security insights
Cloud security, zero trust, and identity guides — straight to your inbox.
Microsoft Cloud Solution Architect
Cloud Solution Architect with deep expertise in Microsoft Azure and a strong background in systems and IT infrastructure. Passionate about cloud technologies, security best practices, and helping organizations modernize their infrastructure.
Questions & Answers
Related Articles
Need Help with Your Security?
Our team of security experts can help you implement the strategies discussed in this article.
Contact Us