A team proposes attaching an Azure DDoS Network Protection plan directly to a Virtual WAN hub to protect branch-to-cloud traffic. How should you respond?
Show answer and explanation
Answer: C
Azure DDoS Network Protection cannot be attached directly to a Virtual WAN hub. The documented approach is to protect a VNet-based inspection point, such as a VNet hosting an Azure Firewall that processes the traffic. FastPath and NSG rules are unrelated to DDoS protection of the hub.
Why the other options are wrong
- A. A hub's gateway is not a supported target for a DDoS Network Protection plan. The plan associates with virtual networks and their public IPs, so this attempt would fail.
- B. FastPath is an ExpressRoute feature that lets data packets bypass the gateway. It does not provide volumetric DDoS mitigation for a Virtual WAN hub.
- D. NSG rules filter traffic by address, port and protocol, but they do not absorb volumetric floods. Dropping DDoS protection leaves the design exposed.