Minimum DDoS Network Protection Plans for Multiple VNets

AZ-700 By islever Editorial Last updated

Short answer

A Deploy one DDoS Network Protection plan for the tenant, because a single plan can protect all virtual networks across subscriptions in the same tenant.

Question

You have the resources shown in the following table. You need to protect the virtual machines by using Azure DDoS Network Protection plans. What is the minimum number of DDoS Network Protection plans you should deploy? - Exhibit: Minimum DDoS Network Protection Plans for Multiple VNets
  1. 1 Correct Answer
  2. 2
  3. 3
  4. 20

Key Takeaways

The question tests the scope of an Azure DDoS Network Protection plan; the trap is assuming a plan is required per virtual network, subscription, or region.

Azure DDoS Network Protection plans can be shared across multiple virtual networks and subscriptions within the same tenant, so the minimum number is one. This page explains why a single plan protects all listed resources, confirming answer A.

Common mistake: Many learners pick 2 or more plans because they assume each subscription or virtual network needs its own DDoS protection plan, but one plan can be associated with multiple VNets across subscriptions in the same tenant.

Expert Analysis

Why the Answer Is Correct

The question asks for the minimum number of Azure DDoS Network Protection plans needed to protect the virtual machines shown in the table. A DDoS Network Protection plan is a tenant-level resource that can be associated with up to 100 virtual networks across multiple subscriptions within the same Azure AD tenant. Because all resources in the table belong to a single tenant, one plan is sufficient to cover every VNet and therefore every VM's public IP. The correct answer is A (1).

Why the Other Options Are Wrong

Option B (2) would imply that each subscription or region needs a separate plan, but Azure allows a single plan to span subscriptions and regions. Option C (3) suggests a plan per virtual network, which is unnecessary because a plan can protect many VNets at once. Option D (20) reflects a plan per public IP or per VM, but DDoS Network Protection is enabled at the VNet level, not per resource, so 20 plans are vastly overprovisioned.

Community Comment Notes

D10SJoker points out that "a single DDoS protection plan can be used across multiple subscriptions" and notes that DDoS IP Protection does not require a plan at all. 4d1c008 initially says it is "just 1 per subscription," which is close but slightly imprecise—the plan can cover multiple subscriptions in the tenant. Saba53 simply concludes "Should be 1," matching the official guidance and the correct answer.

Official Reference

https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question asks for a minimum count of a tenant-scoped Azure resource, check whether the resource can be reused across subscriptions and VNets. If yes, the answer is usually one unless the scenario explicitly involves separate tenants or unsupported regions.

Frequently Asked Questions

Why is one DDoS Network Protection plan enough for multiple VNets?

A single plan can be associated with up to 100 virtual networks across subscriptions in the same tenant, so you do not need one plan per VNet or subscription.

Does DDoS IP Protection also require a DDoS Network Protection plan?

No, DDoS IP Protection is enabled per public IP address and does not require a DDoS protection plan, unlike DDoS Network Protection.

More AZ-700 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. D10SJoker 👍 2 Answered A
    For DDoS Network Protection, under a tenant, a single DDoS protection plan can be used across multiple subscriptions, so there's no need to create more than one DDoS protection plan. For DDoS IP Protection, there's no need to create a DDoS protection plan. Customers can enable DDoS IP protection on any public IP resource. https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview
  2. 4d1c008 👍 1 Answered A
    No sure why the answer is showing up as more than one, but it will be just 1 per subscription.
  3. Saba53 👍 1 Answered A
    Should be 1

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Private Endpoint UDR Routing Prerequisite

S-grade

Minimum Azure Service Endpoints for Peered VNets

S-grade

Logging Application of Specific NSG Rules

S-grade

Azure DNS Private Resolver Minimum Deployment

S-grade

Practice All AZ-700 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AZ-700 Practice Test →

← Back to AZ-700 Study Guide