L9. Azure DDoS Protection
Course outlineLesson 9 of 18
Azure DDoS Protection Standard adds adaptive tuning, attack analytics, and cost guarantees over the free Basic tier. Know the SKU differences, what protection covers, and what it does not: the exam tests both.
Basic vs Standard (Network Protection)
| Feature | Basic (free) | Standard / Network Protection |
|---|---|---|
| Always-on traffic monitoring | Yes | Yes |
| Automatic attack mitigation | Yes | Yes |
| Adaptive tuning | No | Yes |
| Attack analytics and metrics | No | Yes |
| Cost protection guarantee | No | Yes |
| Rapid Response support | No | Yes |
Adaptive Tuning
Standard/Network Protection learns the normal traffic pattern for each protected public IP and dynamically adjusts mitigation thresholds. Basic uses static thresholds: it can block legitimate traffic spikes or miss low-volume volumetric attacks.
What DDoS Protection Covers
DDoS Protection Standard protects:
- Public IP addresses (Azure Public IP resource type)
- Virtual machine NICs with public IPs
- Application Gateway (if it has a public frontend IP)
- Azure Firewall public IP
IP Protection SKU
In 2023 Azure added "IP Protection": a per-IP SKU cheaper than enabling Network Protection on an entire VNet. The exam tests when IP Protection is sufficient: the answer is when you have a small number of public IPs and do not need VNet-wide coverage.
Attack Metrics and Alerts
Standard exposes metrics in Azure Monitor: IfUnderDDoSAttack, BytesDroppedDDoS, PacketsDroppedDDoS. Configure an alert rule on IfUnderDDoSAttack == 1 to notify the SOC when mitigation is active.
- ✓Standard (Network Protection) adds adaptive tuning, attack analytics, and cost protection over Basic
- ✓Basic uses static thresholds; Standard learns each public IP's normal traffic pattern
- ✓DDoS Protection only covers public IPs: private IPs and internal load balancers are not protected
- ✓IP Protection SKU = per-IP billing, cheaper than VNet-wide Network Protection for small deployments
- ✓Alert on IfUnderDDoSAttack metric in Azure Monitor to notify SOC when mitigation activates
1. What does Azure DDoS Network Protection provide that Basic DDoS protection does not?
2. At which layer does Azure DDoS Protection operate?
3. How is DDoS Network Protection applied to resources in an Azure VNet?
Recommended: Pluralsight
This free course covers the theory. Pluralsight adds structured video courses, hands-on Azure labs, and timed practice exams to make it stick before exam day.