DDoS Protection and Security Posture

DDoS attacks flood your public endpoints with traffic until they collapse. Azure provides multiple tiers of protection. Alongside DDoS, Microsoft Defender for Cloud helps you identify security weaknesses before attackers do.

🎬 Video coming soon

~11:00

Simple explanation

A DDoS attack is like a thousand people trying to squeeze through a single door at once — legitimate customers can’t get in. Azure DDoS Protection detects these floods of fake traffic and filters them before they reach your resources. Basic protection is always on and free; Network Protection adds smarter detection tuned to your specific resources.

DDoS Protection Tiers

Azure DDoS Protection Tiers
Feature	Infrastructure Protection	IP Protection	Network Protection
Cost	Free (always on)	Per protected public IP	Per-VNet plan (protects up to 100 IPs)
Scope	All Azure customers automatically	Individual public IPs	All public IPs in protected VNets
Adaptive tuning	Generic thresholds	Per-IP tuning	Per-IP tuning based on traffic patterns
Metrics and alerts	Basic platform metrics	Attack metrics and alerts	Attack metrics, alerts, and diagnostics
Cost protection	No	No	Yes — service credit during attack-related scale-out
DDoS Rapid Response	No	No	Yes — access to Microsoft's DDoS response team
WAF discount	No	No	Yes — Application Gateway WAF included at no extra cost
Attack reports	No	Post-attack reports	Real-time and post-attack reports

Choosing the right tier:

Infrastructure Protection: Automatic for everyone. Handles volumetric attacks at the Azure edge. No configuration needed.
IP Protection: Good for individual public IPs when you don’t need cost protection or rapid response. Pay per IP.
Network Protection: Enterprise choice. One plan protects all VNets and up to 100 public IPs. Includes cost protection (Azure credits you if DDoS causes autoscaling costs), rapid response team access, and WAF discount.

Configuring DDoS Protection

🔒 Aisha’s setup: Sentinel Banking needs maximum DDoS protection for their customer-facing services.

Create a DDoS Protection plan (Network Protection tier)
Associate the plan with VNets that contain public-facing resources
Configure alerts on DDoS attack metrics:
- Under DDoS attack or not — binary 0/1 metric
- Inbound packets dropped — how much malicious traffic was mitigated
- Inbound bytes dropped — volume of attack traffic stopped
Enable diagnostic logs for detailed attack flow records

Exam Tip — DDoS Metrics: The exam tests that you know the metric “Under DDoS attack or not” is a simple 0/1 value. You create an alert rule that triggers when this metric equals 1. The “Inbound packets dropped” metric shows the mitigation in action. These metrics are only available with IP Protection or Network Protection tiers.

What DDoS Protection mitigates:

Volumetric attacks (flood bandwidth — UDP floods, amplification attacks)
Protocol attacks (exploit protocol weaknesses — SYN floods, ping of death)
Application layer attacks (require WAF for full protection — HTTP floods, slow attacks)

DDoS Protection handles L3/L4 attacks. For L7 (application layer) attacks, you also need a Web Application Firewall (WAF) on Application Gateway or Front Door (covered in Domain 5).

Microsoft Defender for Cloud — Network Security Posture

Defender for Cloud assesses your security posture across all Azure resources, including networking. It’s not a DDoS tool — it’s your security advisor.

Secure Score rates your overall security on a 0-100% scale based on how many recommendations you’ve implemented. Network-related recommendations include:

Recommendation	What It Checks
NSG on all subnets	Subnets without associated NSGs
Restrict management ports	RDP/SSH open to the internet
Enable DDoS Protection	VNets without DDoS Protection enabled
Use private endpoints	Services exposed via public endpoints
Enable network flow logs	VNets or NSGs without flow logs
Apply just-in-time VM access	Management ports open 24/7 instead of JIT

🔒 Aisha’s scenario: Sentinel Banking’s Secure Score is 68%. Defender shows 12 network recommendations. The highest-impact ones are:

3 subnets without NSGs
5 VMs with RDP open to internet (should use Bastion or JIT)
2 storage accounts without private endpoints

Fixing these would raise her score to 82%.

Attack Path Analysis (Defender CSPM plan):

Attack path analysis maps how an attacker could chain vulnerabilities to reach sensitive resources:

🔒 Aisha’s example: Defender identifies a path: Internet to VM-Web (port 443 open, outdated OS) to VM-DB (no NSG on subnet, SQL exposed on 1433). The attack path shows that compromising the web server gives access to the database because the database subnet has no NSG.

Cloud Security Explorer lets you query your environment’s security graph:

“Show all VMs with public IPs that have critical vulnerabilities”
“Find all storage accounts accessible from the internet without private endpoints”
“List all subnets without NSGs in production subscriptions”

Defender for Cloud Pricing

Defender for Cloud has two tiers:

Free tier (Foundational CSPM):

Secure Score and basic recommendations
Always available for all Azure subscriptions
Good for basic posture assessment

Defender CSPM (paid):

Attack path analysis
Cloud Security Explorer
Agentless scanning
Governance rules for tracking remediation
Risk-based prioritisation

For the AZ-700 exam, focus on understanding what Defender for Cloud recommends for networking, not the pricing details. The exam tests your ability to identify the right security posture recommendations for network scenarios.

Key Takeaways

Infrastructure DDoS Protection is free and automatic for all Azure customers
Network Protection adds adaptive tuning, cost protection, and rapid response
DDoS handles L3/L4 attacks; WAF is needed for L7 application attacks
Defender for Cloud’s Secure Score tracks network security recommendations
Attack path analysis shows how attackers could chain vulnerabilities

Test Your Knowledge

Question

What are the three DDoS Protection tiers?

Click or press Enter to reveal answer

Answer

1. Infrastructure Protection (free, automatic). 2. IP Protection (per public IP, with metrics). 3. Network Protection (per VNet, includes cost protection, rapid response team, WAF discount).

Click to flip back

Question

What does DDoS 'cost protection' mean?

Click or press Enter to reveal answer

Answer

With Network Protection tier, if a DDoS attack causes your resources to scale out (autoscaling), Azure provides service credits to cover the additional costs. Only available with Network Protection.

Click to flip back

Question

What's the 'Under DDoS attack or not' metric?

Click or press Enter to reveal answer

Answer

A binary 0/1 metric that indicates whether a public IP is currently under active DDoS attack. Create an alert when it equals 1. Available with IP Protection and Network Protection tiers.

Click to flip back

Question

What does Defender for Cloud's Secure Score measure?

Click or press Enter to reveal answer

Answer

A percentage (0-100%) showing how many security recommendations have been implemented. Higher score means better security posture. Network recommendations include NSG coverage, private endpoints, flow logs, and JIT access.

Click to flip back

Knowledge Check

Aisha needs DDoS protection with cost protection and access to Microsoft's rapid response team. Which tier should she choose?

Knowledge Check

DDoS Protection Network tier is enabled on Ravi's VNet. An HTTP flood attack targets his web application. What additional protection does he need?

Next up: Site-to-Site VPN: Connecting On-Premises — Start Domain 2 by building VPN tunnels between Azure and your data centres.