Microsoft Certified: Azure Fundamentals (AZ-900) Practice Exam

What is the Azure service to stop Distributed Denial of Service attacks?

1. Azure Application Gateway

2. Azure DDoS Protection

3. Azure Firewall

4. Azure Blob Storage

The correct answer is: Azure DDoS Protection

The Azure service designed specifically to stop Distributed Denial of Service (DDoS) attacks is indeed Azure DDoS Protection. This service employs various strategies to monitor and mitigate DDoS attacks. It automatically detects and mitigates attacks in real-time, ensuring high availability and responsiveness of the applications running on Azure. Azure DDoS Protection includes features such as adaptive tuning and machine learning-based algorithms that help distinguish between legitimate traffic spikes and potential attacks, allowing it to dynamically adjust protection policies. This layer of security is crucial for preserving the integrity and performance of applications vulnerable to millions of requests per second that DDoS attacks can generate. The other options play different roles in Azure's security and networking domains. Azure Application Gateway is primarily a web traffic load balancer that manages application traffic, while Azure Firewall is a cloud-native network security service providing comprehensive threat protection for your Azure Virtual Network resources. Azure Blob Storage is a service for storing large amounts of unstructured data and is not related to mitigating security threats. Each of these services has its own unique functionalities, but none are specifically tailored for DDoS attack prevention like Azure DDoS Protection is.