Cyber Intelligence
Secure Networking · 20% of exam

L9. Azure DDoS Protection

Course outlineLesson 9 of 18

Azure DDoS Protection Standard adds adaptive tuning, attack analytics, and cost guarantees over the free Basic tier. Know the SKU differences, what protection covers, and what it does not: the exam tests both.

Basic vs Standard (Network Protection)

FeatureBasic (free)Standard / Network Protection
Always-on traffic monitoringYesYes
Automatic attack mitigationYesYes
Adaptive tuningNoYes
Attack analytics and metricsNoYes
Cost protection guaranteeNoYes
Rapid Response supportNoYes
Note: Microsoft rebranded DDoS Protection Standard to "Network Protection" in 2023. The AZ-500 exam uses both names: treat them as identical.

Adaptive Tuning

Standard/Network Protection learns the normal traffic pattern for each protected public IP and dynamically adjusts mitigation thresholds. Basic uses static thresholds: it can block legitimate traffic spikes or miss low-volume volumetric attacks.

What DDoS Protection Covers

DDoS Protection Standard protects:

  • Public IP addresses (Azure Public IP resource type)
  • Virtual machine NICs with public IPs
  • Application Gateway (if it has a public frontend IP)
  • Azure Firewall public IP
Exam trap: DDoS Protection does NOT protect private IPs. If you put an Internal Load Balancer behind a DDoS-protected subnet, the ILB is not protected.

IP Protection SKU

In 2023 Azure added "IP Protection": a per-IP SKU cheaper than enabling Network Protection on an entire VNet. The exam tests when IP Protection is sufficient: the answer is when you have a small number of public IPs and do not need VNet-wide coverage.

Attack Metrics and Alerts

Standard exposes metrics in Azure Monitor: IfUnderDDoSAttack, BytesDroppedDDoS, PacketsDroppedDDoS. Configure an alert rule on IfUnderDDoSAttack == 1 to notify the SOC when mitigation is active.

Exam Focus Points
  • Standard (Network Protection) adds adaptive tuning, attack analytics, and cost protection over Basic
  • Basic uses static thresholds; Standard learns each public IP's normal traffic pattern
  • DDoS Protection only covers public IPs: private IPs and internal load balancers are not protected
  • IP Protection SKU = per-IP billing, cheaper than VNet-wide Network Protection for small deployments
  • Alert on IfUnderDDoSAttack metric in Azure Monitor to notify SOC when mitigation activates
Knowledge Check

1. What does Azure DDoS Network Protection provide that Basic DDoS protection does not?

2. At which layer does Azure DDoS Protection operate?

3. How is DDoS Network Protection applied to resources in an Azure VNet?

Recommended: Pluralsight

This free course covers the theory. Pluralsight adds structured video courses, hands-on Azure labs, and timed practice exams to make it stick before exam day.

Start AZ-500 prep free10-day free trial available