Azure DDoS Protection Tiers and Policies

Azure DDoS Protection is a service that safeguards Azure applications from Distributed Denial-of-Service (DDoS) attacks. These attacks overwhelm a target with traffic from multiple sources, making it unavailable to legitimate users. Azure offers two tiers: Basic (free, automatically enabled for all Azure resources) and Standard (paid, with enhanced features). The Standard tier is the focus of the AZ-500 exam because it provides adaptive tuning, attack mitigation telemetry, and cost protection.

Azure DDoS Protection operates at Layer 3 (Network) and Layer 4 (Transport) of the OSI model, with optional Layer 7 (Application) protection via Application Gateway with WAF. The protection is implemented using a combination of always-on traffic monitoring, adaptive thresholding, and real-time mitigation.

- Traffic Monitoring: Azure monitors traffic to public IP addresses in real-time. It uses a baseline of normal traffic patterns learned over the past few weeks. The baseline includes metrics like packets per second, bytes per second, and connections per second. Any deviation beyond the baseline triggers an alert. - Adaptive Thresholding: Unlike static thresholds, Azure DDoS Protection Standard dynamically adjusts thresholds based on your application's traffic patterns. For example, if your application typically receives 10,000 packets per second (pps), the threshold might be set at 20,000 pps (a multiple of the baseline). This reduces false positives. - Mitigation Actions: When traffic exceeds the threshold, Azure applies mitigation policies. These include: - Source IP rate limiting: Blocks traffic from IPs that exceed a certain rate. - Protocol blocking: Blocks non-standard protocol packets (e.g., malformed TCP packets). - TCP SYN cookies: Protects against SYN floods by requiring connection completion. - Connection limiting: Limits the number of connections per source IP. - Attack Telemetry: After an attack is detected, you can view detailed metrics via Azure Monitor, including attack duration, traffic volume, and mitigation actions taken.

- Tiers: - Basic: Always-on, protects against common network-layer attacks (SYN floods, UDP floods). No configuration needed. No cost. - Standard: Enhanced protection for virtual networks (VNets). Requires enabling on a VNet. Costs approximately $2,944 per month (as of 2025) plus data processing charges. - Metrics: - Packets per second (pps): Default threshold is 2x the baseline. - Bytes per second (bps): Default threshold is 2x the baseline. - Connections per second (cps): Default threshold is 2x the baseline. - Timers: - Baseline learning period: 7 days of traffic data to establish baseline. - Mitigation activation: Within 2-3 minutes of exceeding threshold. - Attack report generation: Available after attack ends, typically within 30 minutes. - Policy customization: You can adjust thresholds via Azure Policy or PowerShell. Custom policies can override defaults.

To enable DDoS Protection Standard on a VNet using Azure CLI:

# Create a DDoS Protection Plan
az network ddos-protection create --resource-group MyResourceGroup --name MyDDoSPlan --location eastus

# Associate VNet with the plan
az network vnet update --resource-group MyResourceGroup --name MyVNet --ddos-protection-plan MyDDoSPlan

To verify configuration:

# Show DDoS Protection status
az network vnet show --resource-group MyResourceGroup --name MyVNet --query "ddosProtectionPlan"

To view attack telemetry:

# List DDoS attacks (requires Standard tier)
az network ddos-protection list-attacks --resource-group MyResourceGroup --ddos-protection-plan MyDDoSPlan

DDoS Protection Standard uses two types of policies: - Default policy: Automatically applied when you enable Standard on a VNet. Uses adaptive thresholds. - Custom policy: You can define specific thresholds for pps, bps, and cps. This is useful for applications with predictable traffic patterns. Custom policies are set via Azure Policy or REST API.

Standard tier includes cost protection: if your Azure resources are scaled out due to a DDoS attack (e.g., auto-scaling), Azure will credit the additional costs incurred. This is a key exam point.

Azure DDoS Protection is a critical security control. The exam tests your understanding of tier differences, policy customization, integration with other services, and cost protection. Know the default thresholds, how adaptive thresholds work, and that Standard requires a plan and VNet association.

A large e-commerce company runs its web application on Azure VMs behind a load balancer. During Black Friday, traffic spikes are expected. However, they also face DDoS attacks from competitors. They enable DDoS Protection Standard on the VNet hosting their web tier. The adaptive thresholds automatically adjust to the high baseline traffic, preventing false positives during legitimate surges. During an actual attack, Azure mitigates the flood, and the platform remains available. The company also uses Azure Front Door for global distribution and WAF for HTTP flood protection. Misconfiguration: They initially set custom thresholds too low, causing false positives during flash sales. They later switched to default adaptive thresholds.

A bank hosts its customer-facing portal on Azure. Compliance requires DDoS protection and attack reporting. They enable DDoS Protection Standard and configure alerts to notify the security team when mitigation starts. During a SYN flood attack, Azure automatically enables SYN cookies. The attack report is used for regulatory audit. They also use Azure Policy to enforce that all VNets in production have DDoS Protection Standard enabled. Common mistake: They forget to enable Standard on a spoke VNet, leaving it vulnerable. After an attack on that spoke, they implement Azure Policy to auto-enable protection.

A gaming company uses Azure for its multiplayer game servers. Traffic is highly variable, with sudden spikes when new games launch. They use DDoS Protection Standard with custom policies to allow higher pps thresholds during launch events. They also integrate with Azure Monitor to track attack metrics. During a UDP amplification attack, Azure rate-limits the offending source IPs. Performance consideration: DDoS Protection adds minimal latency (sub-millisecond) because it operates inline at the network edge. Misconfiguration: They initially set the custom policy too permissive, allowing some attack traffic through. They later adjusted to use adaptive thresholds with a higher multiplier.