Minimum DDoS Network Protection Plans for Cost Minimization
Short answer
A Deploy 1 DDoS Network Protection plan, as it can be linked to VNets across all subscriptions within a single tenant.
Question
Key Takeaways
Tests understanding of DDoS protection licensing scope per tenant versus per subscription. The common trap is assuming one plan is required per subscription or per VNet.
Determines the minimum Azure DDoS Network Protection plans needed to cover multiple subscriptions while minimizing costs. Establishes that a single plan can be linked across all subscriptions within a tenant.
Common mistake: Most users incorrectly chose option B (2 plans), likely assuming a limit based on the number of subscriptions or misinterpreting the 'per tenant' billing model as requiring separate plans for each subscription.
Expert Analysis
Why the Answer Is Correct: According to Microsoft documentation, an Azure DDoS Network Protection plan is billed at the tenant level. A single plan can be associated with any number of virtual networks across all subscriptions within that same tenant. Since the scenario involves three subscriptions but does not specify different tenants, and asks to minimize costs, deploying just one plan covers all resources in all three subscriptions. Therefore, only 1 plan is needed.
Why the Other Options Are Wrong: Option B (2) is incorrect because there is no technical restriction limiting one plan per subscription; the plan scales across the tenant. Options C (3) and D (6) are even more excessive, implying a 1:1 mapping which contradicts the cost-minimization requirement and the actual licensing model.
Community Comment Notes: The community is split between A and B. Users like alinuxguru70 argue for B based on a misunderstanding of IP limits ('One DDOS plan per 100 IP Addresses'), which is factually incorrect for standard DDoS Network Protection. Others correctly point out that 'One plan per tenant' allows covering all subs, supporting answer A. As Saba53 noted, some relied on external AI tools that may have hallucinated constraints.
Official Reference
https://azure.microsoft.com/en-us/pricing/details/ddos-protection/
This link opens the official vendor documentation in a new tab.
Exam Strategy
Always check the scope of billing and resource linkage for security services. For DDoS Network Protection, remember it is a tenant-level service, not a subscription-level one, allowing maximum coverage with minimum cost.
Frequently Asked Questions
Can one DDoS plan protect VNets in different subscriptions?
Is there a limit on IPs per DDoS plan?
Community Votes
62% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 7 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 7
-
alinuxguru70 👍 2 Answered BOne DDOS plan per 100 IP Addresses = 2 plans. Link 3 vNets to plan 1; Link the remaining 3 vNets to plan 2 https://azure.microsoft.com/en-us/pricing/details/ddos-protection/
-
gaurav4101 👍 1 Answered AExample 3 Network Protection plan across the tenant (multiple subscriptions) and multiple VNets with more than 100 Public IPs Let's assume you have 10 subscriptions in your tenant. You create a Networking Protection plan in subscription # 1. The subscription # 1 will be billed $2,944/month. The same plan can now be linked to any VNet across all your 10 subscriptions and across different regions. Let's assume that there are total 110 public IPs that are protected by Network Protection. For each public IP above 100, there's a $29.5 per resource per month charge. Total monthly bill for Network Protection plan will be $2,944/month + $295 ($29.5 per additional resource per month (10 public IPs above 100)) = $3,238/month.
-
Knight_Of_Peace 👍 1 Answered ASuggested answer is: 1 "Example 2 Network Protection plan across the tenant (multiple subscriptions) and multiple VNets Let's assume you have 10 subscriptions in your tenant. You create a Network Protection plan in subscription # 1. The subscription # 1 will be billed $2,944/month. The same plan can now be linked to any VNet across all your 10 subscriptions and across different regions. Total monthly bill for a Network Protection plan will be $2,944/month = $2,944/month." Ref: https://azure.microsoft.com/en-us/pricing/details/ddos-protection/#:~:text=Example%202%20Network%20Protection%20plan,month%20%3D%20%242%2C944/month.
-
dblacksmith 👍 1 Answered A1 plan per tenant Covers all subs in tenant and associated regions in tenant
-
davidy 👍 1 Answered BOne plan per tenant. One plan can cover all subs & regions.
Show 2 more comments
-
Saba53 👍 1 Answered BShould be B - 2 Confirmed by ChatGPT
-
Saba53 👍 1 Answered B2 Should be correct. one per tenant
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All AZ-700 Questions
Access 100 questions with complete answers and detailed explanations.
View Full AZ-700 Practice Test →