Minimum DDoS Network Protection Plans for Cost Minimization

Monitor networks

Answer Correct answer: A — Deploy 1 DDoS Network Protection plan, as it can be linked to VNets across all subscriptions within a single tenant.

You have the Azure subscriptions shown in the following table. Each virtual network contains 20 internet-accessible resources that are assigned public IP addresses. You need to implement Azure DDoS Network Protection to protect the resources. The solution must minimize costs. What is the minimum number of DDoS Network Protection plans you should deploy? -

1 Correct Answer
2
3
6

Community Votes

62%

38%

62% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests understanding of DDoS protection licensing scope per tenant versus per subscription. The common trap is assuming one plan is required per subscription or per VNet.

Determines the minimum Azure DDoS Network Protection plans needed to cover multiple subscriptions while minimizing costs. Establishes that a single plan can be linked across all subscriptions within a tenant.

Most users incorrectly chose option B (2 plans), likely assuming a limit based on the number of subscriptions or misinterpreting the 'per tenant' billing model as requiring separate plans for each subscription.

Community Discussion (7 comments)

Saba53 👍 1 Selected: B

2 Should be correct. one per tenant

dblacksmith 👍 1 Selected: A

1 plan per tenant Covers all subs in tenant and associated regions in tenant

gaurav4101 👍 1 Selected: A

Example 3 Network Protection plan across the tenant (multiple subscriptions) and multiple VNets with more than 100 Public IPs Let's assume you have 10 subscriptions in your tenant. You create a Networking Protection plan in subscription # 1. The subscription # 1 will be billed $2,944/month. The same plan can now be linked to any VNet across all your 10 subscriptions and across different regions. Let's assume that there are total 110 public IPs that are protected by Network Protection. For each public IP above 100, there's a $29.5 per resource per month charge. Total monthly bill for Network Protection plan will be $2,944/month + $295 ($29.5 per additional resource per month (10 public IPs above 100)) = $3,238/month.

Saba53 👍 1 Selected: B

Should be B - 2 Confirmed by ChatGPT

Knight_Of_Peace 👍 1 Selected: A

Suggested answer is: 1 "Example 2 Network Protection plan across the tenant (multiple subscriptions) and multiple VNets Let's assume you have 10 subscriptions in your tenant. You create a Network Protection plan in subscription # 1. The subscription # 1 will be billed $2,944/month. The same plan can now be linked to any VNet across all your 10 subscriptions and across different regions. Total monthly bill for a Network Protection plan will be $2,944/month = $2,944/month." Ref: https://azure.microsoft.com/en-us/pricing/details/ddos-protection/#:~:text=Example%202%20Network%20Protection%20plan,month%20%3D%20%242%2C944/month.

davidy 👍 1 Selected: B

One plan per tenant. One plan can cover all subs & regions.

alinuxguru70 👍 2 Selected: B

One DDOS plan per 100 IP Addresses = 2 plans. Link 3 vNets to plan 1; Link the remaining 3 vNets to plan 2 https://azure.microsoft.com/en-us/pricing/details/ddos-protection/

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct: According to Microsoft documentation, an Azure DDoS Network Protection plan is billed at the tenant level. A single plan can be associated with any number of virtual networks across all subscriptions within that same tenant. Since the scenario involves three subscriptions but does not specify different tenants, and asks to minimize costs, deploying just one plan covers all resources in all three subscriptions. Therefore, only 1 plan is needed.

Why the Other Options Are Wrong: Option B (2) is incorrect because there is no technical restriction limiting one plan per subscription; the plan scales across the tenant. Options C (3) and D (6) are even more excessive, implying a 1:1 mapping which contradicts the cost-minimization requirement and the actual licensing model.

Community Comment Notes: The community is split between A and B. Users like alinuxguru70 argue for B based on a misunderstanding of IP limits ('One DDOS plan per 100 IP Addresses'), which is factually incorrect for standard DDoS Network Protection. Others correctly point out that 'One plan per tenant' allows covering all subs, supporting answer A. As Saba53 noted, some relied on external AI tools that may have hallucinated constraints.

Official Reference

https://azure.microsoft.com/en-us/pricing/details/ddos-protection/

Exam Strategy

Always check the scope of billing and resource linkage for security services. For DDoS Network Protection, remember it is a tenant-level service, not a subscription-level one, allowing maximum coverage with minimum cost.

Frequently Asked Questions

Can one DDoS plan protect VNets in different subscriptions?

Yes. A single DDoS Network Protection plan can be associated with any VNet across all subscriptions within the same Azure AD tenant.

Is there a limit on IPs per DDoS plan?

No. The pricing is flat per tenant/per region pair, regardless of the number of public IP addresses protected by the linked VNets.

Related Analysis

Practice All AZ-700 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AZ-700 Practice Test →

← Back to AZ-700 Study Guide