DDoS protection is often treated as a checkbox — "enable it and move on" — but building genuine resilience requires understanding attack types, detection thresholds, and how DDoS protection interacts with the rest of your architecture. This session provides that deeper understanding.

We'll start by comparing Azure DDoS Protection Basic (enabled by default, always-on) against the Standard tier, covering exactly what additional capabilities Standard provides — adaptive tuning, attack analytics, telemetry, and the cost protection guarantee that reimburses scale-out costs incurred during a documented attack. We'll break down the three main attack categories — volumetric, protocol, and resource-layer (application) attacks — and clarify why DDoS Protection Standard addresses the first two but must be paired with a Web Application Firewall to address the third.

From there, we move into resilience architecture: how to design applications with autoscaling, traffic distribution across regions, and Azure Front Door or Application Gateway in front of backend resources to absorb and filter malicious traffic before it reaches application infrastructure. We'll also cover attack response — what telemetry and alerts look like during an active attack, and how to build a DDoS response runbook so the team isn't improvising under pressure.