AZ-500 Secure networking Practice Question
A company has several critical applications deployed in an Azure virtual network. The security team wants to protect the virtual network against Distributed Denial-of-Service (DDoS) attacks by enabling automatic attack mitigation, adaptive tuning, and access to DDoS Rapid Response Support. Which DDoS Protection tier should they enable for the virtual network?
⚠ Common exam trap
Many candidates confuse the non-existent 'Premium' or 'Advanced' tiers with the actual Standard tier, or assume the free Basic tier includes advanced features like adaptive tuning and DRRS, which are exclusive to the paid Standard tier.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DDoS Protection Standard
DDoS Protection Standard is the correct tier because it provides automatic attack mitigation, adaptive tuning based on traffic patterns, and access to DDoS Rapid Response Support (DRRS) for Azure virtual networks. The Basic tier only offers always-on traffic monitoring and basic mitigation without adaptive tuning or DRRS, while Premium and Advanced are not valid Azure DDoS Protection tiers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DDoS Protection Basic (Free)
Why it's wrong here
Basic is automatically enabled for all Azure services and provides always-on traffic monitoring and mitigation of common network-layer attacks, but it lacks adaptive tuning, attack analytics, alerting, and telemetry. Because it's a shared, static mitigation baseline, it cannot tailor protections to your application's specific traffic profile or provide the SLA-backed guarantees and cost protection that Standard offers. Therefore, while Basic is free, it is insufficient for critical applications.
- ✓
DDoS Protection Standard
Why this is correct
Standard is a paid tier that you enable on a virtual network, providing always-on monitoring, adaptive tuning to your application's traffic patterns, and mitigation of volumetric, protocol, and resource-layer attacks. It delivers real-time telemetry, rich diagnostic logs, and integration with Azure Monitor and Microsoft Defender for Cloud, plus access to DDoS Rapid Response Support for an additional cost. With SLA-backed protection and financial coverage during documented attacks, Standard is the correct tier for critical applications.
- ✗
DDoS Protection Premium
Why it's wrong here
Azure DDoS Protection does not offer a tier named Premium; the only available tiers are Basic and Standard. In the Azure portal and ARM templates, the only valid SKU names are 'Basic' and 'Standard', so Premium cannot be selected. This is a common point of confusion with other Azure services that do have Premium tiers, but for DDoS Protection, Premium is not a real option.
- ✗
DDoS Protection Advanced
Why it's wrong here
There is no 'Advanced' SKU for Azure DDoS Protection; Standard is the highest tier available for securing virtual networks. Commands such as 'az network ddos-protection create' only accept Basic or Standard as the SKU, making Advanced an invalid choice. This distractor may arise from unrelated services like Microsoft Defender for Cloud's 'Advanced' protections, but it has no bearing on DDoS Protection tiers, so it is wrong for critical applications.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.