SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company runs a web application in Azure that is publicly accessible. They want to protect it against large-scale distributed denial-of-service (DDoS) attacks from multiple sources. Which Azure service is specifically designed for this purpose?
⚠ Common exam trap
Test-takers frequently confuse Azure Firewall or Application Gateway WAF as DDoS solutions, but those services handle different layers of defense—Azure Firewall for network filtering and WAF for application-layer attacks—whereas only Azure DDoS Protection is designed to absorb and mitigate large-scale volumetric attacks from multiple sources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure DDoS Protection
Azure DDoS Protection is specifically designed to safeguard Azure resources against large-scale distributed denial-of-service (DDoS) attacks. It leverages the global scale of Microsoft's network to absorb and mitigate multi-gigabit attacks, providing always-on traffic monitoring and adaptive tuning. This service is the only option among the choices that is purpose-built for DDoS mitigation at the network and transport layers (L3/L4), and it also offers application-layer (L7) protection when combined with Application Gateway WAF.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a stateful, managed network security service that provides centralized network policy enforcement for virtual networks and subscriptions. While it offers network and application layer filtering (Layer 3-7), it is designed for controlling outbound/inbound traffic and segmentation, not for mitigating the volumetric and protocol-based attacks characteristic of large-scale Distributed Denial of Service (DDoS) events. It lacks the specialized scrubbing centers and global scale required to absorb and filter massive DDoS traffic floods before they overwhelm Azure resources.
- ✓
Azure DDoS Protection
Why this is correct
Azure DDoS Protection provides always-on traffic monitoring and automatic mitigation capabilities specifically designed to protect Azure resources from volumetric, protocol, and resource-layer DDoS attacks. It leverages Azure's global network scale to absorb and scrub malicious traffic at the network edge before it reaches the target application, ensuring legitimate traffic flow. This service is essential for publicly accessible applications in Azure, offering comprehensive protection against sophisticated denial-of-service threats.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) solution that provides security recommendations, vulnerability assessments, and threat detection across hybrid and multi-cloud environments. Its primary focus is on improving security posture, identifying misconfigurations, and detecting threats within workloads and resources. It does not, however, offer direct, real-time DDoS attack mitigation at the network perimeter, which is a specialized function handled by dedicated DDoS protection services.
- ✗
Azure Application Gateway with Web Application Firewall (WAF)
Why it's wrong here
Azure Application Gateway with Web Application Firewall (WAF) primarily operates at Layer 7 (HTTP/HTTPS) to protect web applications from common web-specific vulnerabilities, such as SQL injection, cross-site scripting, and other OWASP Top 10 threats. While it can offer some protection against small, application-layer DDoS attacks by filtering malicious requests, it is not designed to withstand or mitigate large-scale volumetric or protocol-based DDoS attacks that target the network infrastructure or exhaust connection limits at lower layers. Dedicated DDoS protection is required for such broad-spectrum defense.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Distributed Denial-of-service
A cyberattack where many compromised computers flood a target system with traffic, making it unavailable to legitimate users.
Key term
Denial-of-service
A Denial-of-service (DoS) attack is an attempt to make a computer, network, or online service unavailable to its intended users by overwhelming it with fake traffic or requests.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.