AZ-305 Design infrastructure solutions Practice Question
Which TWO Azure networking services provide DDoS protection at the application layer (Layer 7)?
⚠ Common exam trap
Test-takers frequently confuse Azure DDoS Protection Standard (Layer 3/4) with application-layer protection, or assume Azure Firewall provides Layer 7 inspection, when in fact only WAF-enabled services like Front Door Premium and Application Gateway offer Layer 7 DDoS defense.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Front Door Premium with WAF
Azure Front Door Premium includes a web application firewall (WAF) that operates at Layer 7, inspecting HTTP/HTTPS traffic for application-layer attacks such as SQL injection and cross-site scripting. This integration provides both global load balancing and application-layer DDoS protection, making it a correct answer for Layer 7 DDoS defense.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Front Door Premium with WAF
Why this is correct
Azure Front Door Premium includes an integrated web application firewall (WAF) that provides Layer 7 DDoS protection by inspecting HTTP/S traffic at Microsoft's global edge. Its distributed anycast architecture absorbs and mitigates application floods close to the source, preventing malicious requests from overwhelming backend origins, which is why this is a correct choice.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a stateful network firewall that filters traffic based on IP addresses, ports, protocols, and FQDN tags, but it does not include a dedicated DDoS detection or mitigation engine. It can restrict attack surface, yet it cannot automatically absorb volumetric floods or distinguish application-layer attack patterns, so it is not considered a DDoS protection service.
- ✗
Azure DDoS Protection Standard
Why it's wrong here
Azure DDoS Protection Standard mitigates large-scale network and transport-layer attacks such as SYN floods, UDP reflection, and volumetric assaults against public IPs. However, it does not inspect application payloads or HTTP semantics, so it cannot stop Layer 7 application attacks like HTTP request floods, making it incorrect for this question that expects WAF-based Layer 7 DDoS protection.
- ✓
Azure Web Application Firewall on Azure Application Gateway
Why this is correct
Azure Web Application Firewall on Azure Application Gateway provides Layer 7 DDoS protection by inspecting inbound HTTP/HTTPS traffic with rules for SQL injection, cross-site scripting, and rate limiting. It mitigates application-layer floods and protocol attacks locally in the Azure region before they reach backend web servers, so it is one of the two correct DDoS protection services.
- ✗
Azure Bastion
Why it's wrong here
Azure Bastion is a managed jump-host service that provides secure browser-based RDP and SSH connectivity to virtual machines without exposing public IP addresses. It does not inspect or filter traffic for DDoS patterns, nor does it provide any mitigation capacity, so it is completely unrelated to DDoS protection.
Go deeper
Related to this question
Learn chapter
Azure Front Door vs Traffic Manager
Key term
Application Gateway Design
Application Gateway Design is the process of planning and configuring a layer 7 load balancer in Azure that routes web traffic based on URL paths, hostnames, or other HTTP rules for secure, scalable, and high-performance application delivery.
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.