Azure DDoS Protection Default Capabilities and Scope
Short answer
Tests the distinction between default availability protection (DDoS) and integrity/security controls (MITM prevention). 1. Yes; 2. No; 3. Yes.
Question
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Key Takeaways
Tests the distinction between default availability protection (DDoS) and integrity/security controls (MITM prevention).
Determines the truth of statements about Azure DDoS Protection: it is enabled by default, protects against L3/L4 attacks, but does not prevent MITM attacks.
Common mistake: Marking Statement 1 as No because learners assume DDoS protection is a paid add-on, or marking Statement 2 as Yes by conflating DDoS protection with general network security like TLS.
Expert Analysis
The question requires evaluating three statements regarding Azure DDoS Protection. The correct evaluation relies on understanding the default capabilities versus premium features of Azure's infrastructure security.
Statement 1: 'Azure DDoS Protection is enabled by default for all Azure customers.' This is Yes (True). Microsoft enables basic, infrastructure-level DDoS protection at no additional cost for all Azure subscriptions. This default protection mitigates common volumetric attacks but does not include advanced tuning or application-layer protections.
Statement 2: 'Azure DDoS Protection protects against Man-in-the-Middle (MITM) attacks.' This is No (False). DDoS protection services are designed to handle availability threats (volume, protocol, resource exhaustion) at Layers 3 and 4. MITM attacks are integrity/confidentiality threats typically addressed by encryption (TLS/SSL), certificates, and identity verification, not network-level DDoS mitigation.
Statement 3: 'Azure DDoS Protection actively protects against Layer 3 and Layer 4 protocol attacks.' This is Yes (True). Both the Basic (default) and Standard tiers provide active protection against Layer 3 (Network) and Layer 4 (Transport) attacks. The key differentiator is that Standard tier includes proactive response teams and tuning, while Basic provides baseline mitigation.
The most attractive wrong answer approach often involves confusing "Basic" with "Standard." Learners might think DDoS protection is an add-on feature requiring purchase (leading them to mark Statement 1 as No), or they might overestimate its scope, believing it secures data integrity against MITM attacks (leading them to mark Statement 2 as Yes). However, the exam doctrine clearly separates availability protection (DDoS) from integrity protection (Encryption/Certificates).
Answer Summary:
- Yes
- No
- Yes
Official Reference
- https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview
- https://learn.microsoft.com/en-us/azure/networking/design-guide/ddos
These links open the official vendor documentation in a new tab.
Exam Strategy
When answering questions about Azure security services, always distinguish between 'availability' (DDoS, uptime) and 'integrity/confidentiality' (encryption, access control). For DDoS specifically, remember that basic protection is free and default, focusing only on volumetric L3/L4 attacks, not application-layer or MITM threats.
Frequently Asked Questions
Is Azure DDoS Protection free?
Does DDoS Protection stop MITM attacks?
What layers does Azure DDoS Protection cover?
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
lukasbochis 👍 2I think the correct answer would be NNY
-
blh_ 👍 1Answer is correct. N - No, Azure DDoS Protection does not protect against Man-in-the-Middle (MITM) attacks. Y - Yes, basic infrastructure-level Azure DDoS Protection is enabled by default at no extra cost for all Azure customers. Y - Azure DDoS Protection (including Network and IP Protection tiers) actively protects against Layer 3 and Layer 4 protocol attacks by differentiating between malicious and legitimate traffic and blocking threats.
-
blh_ 👍 1I see what you mean from your reference DDoS Network Protection = "Per-plan (covers up to 100 public IPs per tenant)". Is this not default once a subscription is established?
-
microfuzzy 👍 1I would say NNY based on https://learn.microsoft.com/en-us/azure/networking/design-guide/ddos?pivots=lift-shift.The key is "Network" protection which requires a plan.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-900 Questions
Access 141 questions with complete answers and detailed explanations.
View Full SC-900 Practice Test →