4.1.1. Azure DDoS Protection
💡 First Principle: A distributed denial-of-service (DDoS) attack tries to overwhelm a resource with sheer traffic volume until it can't serve legitimate users, so Azure DDoS Protection exists specifically to absorb and filter that volumetric flood before it reaches your application — a job no firewall or WAF is built to do at that scale.
Azure includes basic DDoS protection automatically for every resource at the platform level, but DDoS Protection (Standard/enhanced tiers) adds tuned, resource-specific mitigation policies, always-on traffic monitoring, and near-real-time attack analytics for virtual networks that need a stronger guarantee.
⚠️ Exam Trap: DDoS Protection defends against volumetric flooding attacks specifically — it is not the tool for blocking application-layer attacks like SQL injection or cross-site scripting; that's the Web Application Firewall's job (4.1.3).
Reflection Question: Why can't a standard firewall or WAF, which inspects individual requests, effectively stop a DDoS attack built on sheer traffic volume?
