AZ-500 Secure networking Practice Question
A company runs a public-facing web application on Azure App Service in the West US region. They want to protect against network-layer (Layer 3/4) DDoS attacks. The application consists of a single App Service instance. Which Azure DDoS Protection tier should they enable to meet this requirement while minimizing cost?
⚠ Common exam trap
Test-takers frequently assume Azure App Service has no built-in DDoS protection and that they must purchase a paid tier, but Azure DDoS Protection Basic is automatically enabled and free, making it the correct choice for cost-effective Layer 3/4 protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Basic
Azure DDoS Protection Basic is automatically enabled at no additional cost for all Azure services, including App Service. It provides always-on traffic monitoring and real-time mitigation of common network-layer (Layer 3/4) attacks, such as SYN floods, UDP floods, and reflection attacks, which meets the requirement to protect the public-facing web application. Since the company wants to minimize cost and only needs Layer 3/4 protection for a single App Service instance, the Basic tier is sufficient.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Basic
Why this is correct
DDoS Protection Basic is free and automatically included for all Azure resources. It provides protection against common network-layer attacks, making it the simplest and most cost-effective choice for a single web application.
- ✗
Standard
Why it's wrong here
DDoS Protection Standard is a paid tier that offers enhanced features like adaptive tuning, detailed metrics, and protection for multiple virtual networks. It is not required for a single App Service instance and would incur unnecessary cost.
- ✗
Premium
Why it's wrong here
There is no 'Premium' tier for Azure DDoS Protection. The available tiers are Basic and Standard.
- ✗
No protection is needed because Azure App Service is inherently protected against DDoS attacks.
Why it's wrong here
While Basic protection is automatic, it is not correct to say no protection is needed. Basic is sufficient, but it is a form of protection.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.