AZ-500 · Question #647
Hotspot Question You have an Azure subscription that contains the virtual networks shown in the following table: The subscription contains the resources shown in the following table. You create an…
Azure DDoS Protection Plan - Hotspot Question Analysis > Note: The resource tables aren't visible in your message, but this matches a well-known AZ-104 exam pattern. The explanation below is based on the standard version of this question where VM1 is a VM in a VNet (East US)…
Question
Exhibits
Answer Area
- DDoS1 can protect VM1.
- DDoS1 can protect App1.
- DDoS1 can protect FW1.
Explanation
Azure DDoS Protection Plan - Hotspot Question Analysis
Note: The resource tables aren't visible in your message, but this matches a well-known AZ-104 exam pattern. The explanation below is based on the standard version of this question where VM1 is a VM in a VNet (East US), App1 is an Azure App Service, and FW1 is Azure Firewall in a VNet.
Key Concept First
An Azure DDoS Protection plan:
- Is linked to virtual networks, not individual resources
- Protects resources with public IPs inside VNets
- Can protect VNets in any region - the plan's own region (East US) does not restrict coverage
- Does not protect PaaS services like App Service
Statement 1: "DDoS1 can protect VM1" -> Yes
VM1 is a virtual machine deployed inside a VNet with a public IP address. DDoS Protection works at the VNet level - once you associate the DDoS plan with VM1's VNet, all public IP resources in that VNet (including VM1's NIC/IP) are protected. The plan region is irrelevant.
Statement 2: "DDoS1 can protect App1" -> No
Azure App Service is a PaaS (Platform as a Service) offering. It does not run inside a customer-managed VNet (unless using VNet Integration, which is outbound-only). DDoS Network Protection applies only to resources with public IPs within a VNet. App Service has its own Microsoft-managed infrastructure protection but is not covered by a customer DDoS plan.
Statement 3: "DDoS1 can protect FW1" -> Yes
Azure Firewall is deployed inside a VNet and is assigned a public IP address. Because it lives in a VNet with a public IP, it qualifies for DDoS Network Protection - even if that VNet is in a different region than the DDoS plan (e.g., West US). DDoS plans are globally applicable across regions and subscriptions.
Memory Tip
"VNet + Public IP = DDoS-eligible; PaaS = No"
Ask two questions about any resource:
- Is it deployed inside a VNet? (VMs, Azure Firewall, Load Balancers = YES; App Service, Azure SQL = NO)
- Does it have a public IP?
If both answers are YES -> DDoS Protection can cover it. If it's a managed PaaS service -> it cannot.
Topics
Community Discussion
No community discussion yet for this question.