Minimum DDoS Network Protection Plans for Multiple VNets
You have the resources shown in the following table. You need to protect the virtual machines by using Azure DDoS Network Protection plans. What is the minimum number of DDoS Network Protection plans you should deploy? - 
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the scope of an Azure DDoS Network Protection plan; the trap is assuming a plan is required per virtual network, subscription, or region.
Azure DDoS Network Protection plans can be shared across multiple virtual networks and subscriptions within the same tenant, so the minimum number is one. This page explains why a single plan protects all listed resources, confirming answer A.
Many learners pick 2 or more plans because they assume each subscription or virtual network needs its own DDoS protection plan, but one plan can be associated with multiple VNets across subscriptions in the same tenant.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The question asks for the minimum number of Azure DDoS Network Protection plans needed to protect the virtual machines shown in the table. A DDoS Network Protection plan is a tenant-level resource that can be associated with up to 100 virtual networks across multiple subscriptions within the same Azure AD tenant. Because all resources in the table belong to a single tenant, one plan is sufficient to cover every VNet and therefore every VM's public IP. The correct answer is A (1).Why the Other Options Are Wrong
Option B (2) would imply that each subscription or region needs a separate plan, but Azure allows a single plan to span subscriptions and regions. Option C (3) suggests a plan per virtual network, which is unnecessary because a plan can protect many VNets at once. Option D (20) reflects a plan per public IP or per VM, but DDoS Network Protection is enabled at the VNet level, not per resource, so 20 plans are vastly overprovisioned.Community Comment Notes
D10SJoker points out that "a single DDoS protection plan can be used across multiple subscriptions" and notes that DDoS IP Protection does not require a plan at all. 4d1c008 initially says it is "just 1 per subscription," which is close but slightly imprecise—the plan can cover multiple subscriptions in the tenant. Saba53 simply concludes "Should be 1," matching the official guidance and the correct answer.Official Reference
Exam Strategy
When a question asks for a minimum count of a tenant-scoped Azure resource, check whether the resource can be reused across subscriptions and VNets. If yes, the answer is usually one unless the scenario explicitly involves separate tenants or unsupported regions.
Frequently Asked Questions
Why is one DDoS Network Protection plan enough for multiple VNets?
A single plan can be associated with up to 100 virtual networks across subscriptions in the same tenant, so you do not need one plan per VNet or subscription.
Does DDoS IP Protection also require a DDoS Network Protection plan?
No, DDoS IP Protection is enabled per public IP address and does not require a DDoS protection plan, unlike DDoS Network Protection.
Related Analysis
Practice All AZ-700 Questions
Access 100 questions with complete answers and detailed explanations.
View Full AZ-700 Practice Test →