A reviewer says Azure already includes DDoS protection so nothing more is needed for a public Application Gateway and a public Azure Firewall. What distinction should the security engineer make?
Select an answer to reveal the explanation.
Short Explanation
Basic platform DDoS is the free umbrella—coarse and quiet. DDoS Protection Standard is what you buy when those public IPs need adaptive tuning, metrics, alerts, and real mitigation reports.
Full Explanation
Azure always includes baseline platform and infrastructure DDoS protection, but it is coarse and lacks per-application telemetry. For a public Application Gateway and a public Azure Firewall on canal edges that need adaptive tuning, metrics, alerts, and mitigation reports, recommend Azure DDoS Protection Standard (exam wording; product docs may also say Network Protection or IP Protection). Distinguishing platform protection from Standard prevents under-scoping internet-facing public IPs that night shift must monitor.
Agreeing that platform DDoS and DDoS Protection Standard are identical fails by concept: they differ in telemetry, tuning, and operational response features. Recommending only WAF Prevention mode as a complete replacement fails by concept: WAF addresses application-layer attacks and does not fully replace network-layer DDoS Protection Standard on public IPs. Disabling public IPs on Application Gateway and Firewall to claim DDoS product choice no longer matters fails by concept: that may be valid elsewhere but does not answer when to recommend Standard for public IPs you retain.
Exam caveat: platform DDoS is not Standard; WAF is not DDoS Protection Standard—know what each layer covers. Operational check: enable DDoS Protection Standard on the virtual network or public IP plan covering the Application Gateway and Firewall public IPs, verify metrics and alerts are flowing, and run a tabletop on mitigation reports without removing those public edges.