Azure DDoS Protection for VM Network Monitoring
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a virtual machine named VM1 that runs Windows Server and is publicly accessible. You suspect that VM1 has been the target of a malicious network attack. You need to monitor network traffic to VM1, collect attack metrics, such as the SYN packet count, and automatically generate alerts if another attack begins. The solution must minimize administrative effort. What should you use?
Community Insight
The question asks for a solution that monitors attack metrics like SYN packets and generates alerts automatically; Azure DDoS Protection is the only service designed specifically for this type of network-layer threat detection and alerting with minimal management.
This question tests the use of Azure DDoS Protection to monitor network traffic and generate alerts for SYN packet attacks. The correct solution minimizes administrative effort by leveraging integrated metrics.
Many learners choose Azure Monitor metrics and alerts (A) because it handles general monitoring, but they miss that Azure Monitor alone does not inherently collect or analyze specific DDoS attack metrics like SYN floods without the DDoS Protection resource providing that data.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Azure DDoS Protection Standard provides automatic tuning and real-time protection against DDoS attacks. It integrates directly with Azure Monitor to expose metrics such as SYN packet counts and other attack indicators. By configuring alerts on these metrics within the DDoS Protection plan, you can automatically detect and respond to attacks with minimal administrative overhead, fulfilling the requirement to minimize effort.Why the Other Options Are Wrong
Azure Monitor metrics and alerts (A) are a general-purpose tool; while they can trigger alerts, they do not natively collect deep network attack telemetry like SYN flood specifics without being fed by a source like DDoS Protection. Azure Application Gateway diagnostics (B) focus on web application logs and performance, not low-level network attack metrics. Azure Network Watcher packet capture (D) is a reactive forensic tool requiring manual initiation and analysis, which violates the 'automatically generate alerts' and 'minimize administrative effort' constraints.Community Comment Notes
The community consensus strongly favors option C. As blh_ noted, "Correct. You should use Azure DDoS Protection integrated with Azure Monitor metrics and alerts to automatically monitor attacks and minimize administrative effort." This highlights the integration aspect which is key to the automated alerting capability.Official Reference
Exam Strategy
When a question mentions 'SYN packet count' or 'DDoS', think Azure DDoS Protection first. Always look for the combination of 'automatic' and 'minimize administrative effort' to rule out manual tools like Packet Capture.
Frequently Asked Questions
Why not use Azure Monitor metrics directly?
Azure Monitor collects metrics but doesn't natively parse DDoS-specific signals like SYN floods without a dedicated provider like DDoS Protection feeding that data.
Is Packet Capture useful for automatic alerts?
No, Packet Capture is a manual diagnostic tool for troubleshooting existing issues, not for automated real-time alerting.
Related Analysis
Practice All SC-900 Questions
Access 141 questions with complete answers and detailed explanations.
View Full SC-900 Practice Test →