AZ104-Q: protect Internet-facing IP resources
A company wants enhanced DDoS protections and telemetry for multiple public IP resources in a VNet. What should it consider?
- A) A resource-group tag only.
- B) Azure DDoS Protection associated with the VNet, after validating the plan and protected-resource design. ✓
- C) A private DNS zone.
- D) An Azure Bastion host. Answer: B. DDoS Protection is a VNet-level service for eligible public IP resources. Why not the others: Tags, DNS, and Bastion do not provide DDoS mitigation.