AZ-500 Secure networking Practice Question
A company runs a public-facing web application on Azure App Service in the West US region. They want to protect against network-layer (Layer 3/4) DDoS attacks and have a single web application. Which Azure DDoS Protection tier should they use?
⚠ Common exam trap
Test-takers frequently assume DDoS Protection Standard is always required for any DDoS protection, overlooking that Basic is automatically enabled and sufficient for Layer 3/4 attacks on a single resource, while Standard is an enhanced add-on for complex, multi-resource environments needing advanced features.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DDoS Protection Basic (default)
DDoS Protection Basic is automatically enabled for all Azure resources at no additional cost, providing always-on traffic monitoring and real-time mitigation of common network-layer (Layer 3/4) attacks, such as SYN floods, UDP floods, and reflection attacks. Since the company has a single web application and only needs protection against Layer 3/4 DDoS attacks, the Basic tier is sufficient and requires no configuration or extra cost.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DDoS Protection Basic (default)
Why this is correct
DDoS Protection Basic is automatically enabled for all Azure resources, including a public-facing Azure App Service, at no additional cost and with no configuration required. It performs always-on traffic monitoring and real-time mitigation of common network-layer attacks such as SYN floods, UDP floods, and reflection attacks at Azure's global edge. For a single App Service, this default protection is sufficient because the platform itself shields the application from volumetric L3/L4 threats, and Basic is the correct baseline expectation.
- ✗
DDoS Protection Standard
Why it's wrong here
DDoS Protection Standard must be enabled on a virtual network and provides enhanced mitigation capabilities, dedicated traffic monitoring, and cost protection. It is not required for a single App Service because Basic already covers network-layer attacks.
- ✗
Azure Web Application Firewall (WAF) on Application Gateway
Why it's wrong here
Azure Web Application Firewall (WAF) on Application Gateway is a Layer 7 (application-layer) security service that inspects inbound HTTP/HTTPS traffic to block attacks like SQL injection and cross-site scripting. It does not provide any network-layer (Layer 3/4) DDoS mitigation—for instance, it has no ability to absorb SYN floods or UDP amplification attacks. While WAF can complement DDoS Protection in a layered defense, deploying Application Gateway with WAF does not replace the always-on DDoS Protection Basic that already shields the App Service's underlying public endpoint, so it is the wrong solution for this specific network-layer DDoS requirement.
- ✗
Azure Front Door with DDoS Protection Standard
Why it's wrong here
Front Door provides global load balancing and can have DDoS Protection Standard enabled on its associated virtual network, but this is an unnecessary for the stated requirement for a single App Service and incurs additional cost. Basic remains the default and sufficient option.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.