4.1.1. Azure DDoS Protection
💡 First Principle: A distributed denial-of-service (DDoS) attack tries to overwhelm a resource with sheer traffic volume until it can't serve legitimate users, so Azure DDoS Protection exists specifically to absorb and filter that volumetric flood before it reaches your application — a job no firewall or WAF is built to do at that scale.
Azure includes DDoS infrastructure protection automatically, at no extra cost, for every service with a public IP address. Two paid tiers add mitigation tuned to your own traffic, always-on monitoring, alerts, and attack reports: DDoS Network Protection, enabled per virtual network (and adding rapid-response support and cost protection), and DDoS IP Protection, enabled per individual public IP address.
⚠️ Exam Trap: DDoS Protection defends against volumetric flooding attacks specifically — it is not the tool for blocking application-layer attacks like SQL injection or cross-site scripting; that's the Web Application Firewall's job (4.1.3).
Reflection Question: Why can't a standard firewall or WAF, which inspects individual requests, effectively stop a DDoS attack built on sheer traffic volume?
