An organization is implementing a defense-in-depth strategy to protect its cloud workloads in Azure. The security team needs to implement controls that filter external traffic at the network edge and protect cloud services from large-scale Distributed Denial of Service (DDoS) attacks before malicious requests can reach internal virtual networks. Which layer of the defense-in-depth model addresses these requirements?

Perimeter layer: ### What the Perimeter Layer Is The **perimeter layer** is the boundary in the **defense-in-depth** model focused on protecting an organization's network edge from external, internet-based threats. It serves as the initial line of defense against network-wide disruptions and unauthorized external traffic. ### How It Meets the Requirements - **DDoS Mitigation**: By placing **Azure DDoS Protection** at the perimeter, organizations can detect and absorb large-scale volumetric traffic floods before they saturate network resources. - **Edge Filtering and Inspection**: Utilizing tools like **Azure Firewall** or **Network Virtual Appliances (NVAs)** in a perimeter network (DMZ) enables packet inspection and filtering of external traffic before it ever enters internal subnets. ### Key Capabilities - Mitigates network-level and transport-level **DDoS attacks** automatically. - Filters inbound and outbound traffic through centralized **firewall rules** and threat intelligence. - Protects web applications at the edge using **Web Application Firewall (WAF)** capabilities. - Isolates public entry points from internal resources through **perimeter networks (DMZs)**. ### Why This Is Optimal The perimeter layer stops attacks at the external boundary before they can consume internal compute, network, or storage resources, preventing downstream service outages across the entire architecture.