Exam AZ-301 topic 6 question 21 discussion

Rate limiting is the only possible option . NSG has nothing to do with DDOS.

Rate limit should be correct! A rate limiting solution measures the amount of time between each request from each IP address, and also measures the number of requests within a specified timeframe. If there are too many requests from a single IP within the given timeframe, the rate limiting solution will not fulfill the IP address's requests for a certain amount of time.

C. Enable rate limiting.

given answer is correct.

Rate limiting is the correct answer

rate limit will not solve the ddos attack because the genuine requests will be lost if rate limit is implemented. it needs to be handled before request reached APIM which is NSG

Answer is correct

https://docs.microsoft.com/en-us/azure/security/fundamentals/ddos-best-practices Defense in depth ... Network security groups (NSGs) are another way to reduce the attack surface. You can use service tags and application security groups to minimize complexity for creating security rules and configuring network security, as a natural extension of an application’s structure.

I think A. NSGs is the correct answer. It prevents DDoS from the boundary. Enable rate limiting may reject the request but the attack traffic already hit the Azure inside.

As of today, the best answer would be “Enable Azure DDoS Protection Standard on the Vnet associated with your API Management deployment to protect from distributed denial of service (DDoS) attacks.” From https://docs.microsoft.com/en-us/azure/api-management/security-baseline. But as this is not in the answers, I guess rate limit is the best choice. It has more options to control DDoS attacks in a world open scenario where legitimate requests can come from everywhere https://docs.microsoft.com/en-us/azure/api-management/api-management-sample-flexible-throttling

NSG is correct even though it is basic. http://work.haufegroup.io/securing-backends-azure-apim/

NSG is the correct answer and it's do DDOS. https://hub.packtpub.com/secure-azure-virtual-network/

Answer is correct, on the azure documentation says about rate limit "you may want to limit a number of calls the API is called so it is not overused by developers"

answer is correct. https://docs.microsoft.com/en-us/azure/api-management/transform-api

https://docs.microsoft.com/en-us/azure/api-management/api-management-sample-flexible-throttling

agree with A answer You can reduce the surface area by using whitelisting to close down the exposed IP address space and listening ports that are not needed on the load balancers (Azure Load Balancer and Azure Application Gateway). Network security groups (NSGs) are another way to reduce the attack surface.

I think that the correct answer is A. BTW, DDOS protection is available by default for any Vnet. as for: https://docs.microsoft.com/en-us/azure/virtual-network/manage-ddos-protection#enable-ddos-for-a-new-virtual-network