AZ-900 Describe Azure architecture and services Practice Question
A company needs to protect their Azure VMs from DDoS attacks at the network layer. Which Azure service provides this protection?
⚠ Common exam trap
It's easy for candidates to confuse Azure Firewall or NSGs with DDoS protection because they both filter traffic, but they serve fundamentally different purposes—access control versus volumetric attack mitigation—and only DDoS Protection Standard handles network-layer DDoS attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure DDoS Protection Standard
Azure DDoS Protection Standard is the correct service because it provides dedicated mitigation against Distributed Denial of Service (DDoS) attacks targeting Azure virtual machines at the network layer (Layer 3/4). It uses adaptive tuning, traffic monitoring, and automatic attack mitigation to protect public IP addresses associated with Azure resources, including VMs, without requiring any application-level changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a managed, cloud-native firewall service that provides centralized policy enforcement and stateful inspection for inbound and outbound traffic. It can filter traffic based on network rules, application rules, and threat intelligence feeds, but it is not designed to detect or automatically absorb DDoS flood traffic. Because DDoS attacks saturate the network pipe, Azure Firewall would still receive and process the flood, but it lacks the capacity or detection algorithms of DDoS Protection Standard and cannot mitigate the attack on its own.
- ✓
Azure DDoS Protection Standard
Why this is correct
Azure DDoS Protection Standard is the purpose-built service for defending Azure hosted resources against distributed denial-of-service attacks. It provides always-on traffic monitoring, adaptive tuning, and automatic mitigation for volumetric, protocol, and resource-layer attacks across Layers 3, 4, and 7. When enabled on a virtual network, it learns normal baseline traffic patterns and can neutralize malicious traffic within two minutes, while also offering cost protection and detailed attack analytics.
- ✗
Network Security Groups
Why it's wrong here
Network Security Groups (NSGs) filter east-west and north-south traffic by source/destination IP, port, and protocol, and they are stateful packet filters. They cannot detect or mitigate volumetric DDoS attacks because they do not have the capacity to absorb large-scale traffic. An NSG only evaluates each packet against rule-based permissions; when a flood arrives, it may drop packets, but the attack still consumes the network link's bandwidth before the NSG can act.
- ✗
Azure WAF
Why it's wrong here
Azure WAF is a Layer 7 protection service that inspects HTTP/S requests for common web exploitation patterns, such as SQL injection and cross-site scripting, using the OWASP Top 10 rule set. It does not monitor or react to Layer 3/4 network-level volumetric floods that saturate the pipe, nor can it absorb spoofed UDP floods or protocol attacks. WAF is meant to be layered on top of network protection, not as a substitute for DDoS mitigation.
Go deeper
Related to this question
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.