Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.
2.4.3. DDoS Protection
DDoS Protection defends Azure resources against volumetric, protocol, and application-layer attacks.
Tiers:
| Feature | DDoS Network Protection | DDoS IP Protection |
|---|---|---|
| Scope | Entire VNet | Individual public IPs |
| Cost | $2,944/month + overage | Per-IP pricing |
| Adaptive tuning | Yes | Yes |
| Attack analytics | Yes | Yes |
| Cost protection | Yes (credit for scale-out) | No |
| Rapid Response team | Yes | No |
When to Choose Each:
- DDoS Network Protection: Enterprise with many public IPs, need cost protection guarantee
- DDoS IP Protection: Smaller deployments, specific critical IPs only
⚠️ Exam Trap: DDoS Infrastructure Protection (the tier formerly called Basic) is enabled automatically for every Azure resource at no cost. The paid tiers — Network Protection (formerly Standard) and IP Protection — add adaptive tuning, telemetry and alerting, and cost guarantees. Questions still written against the old Basic/Standard names are testing whether you know the current ones.
Microsoft Defender for Cloud Integration:
Defender for Cloud provides security recommendations for your network:
| Feature | What It Does |
|---|---|
| Secure Score | Overall security posture rating |
| Attack Path Analysis | Visual attack path identification |
| Security Explorer | Query-based resource exploration |
Enroll to unlock the 3 practice questions written for this section, so you can test what you just read while it is fresh.
Enroll to unlock the 4 flashcards for this section and review them on a spaced-repetition schedule.
Written byAlvin Varughese
Founder•20 professional certifications