A mission-critical web application is published through Azure Application Gateway (WAF) and protected by Azure Firewall in a hub-and-spoke topology. You must achieve automatic L3/L4 DDoS mitigation for the app’s public endpoints, collect detailed attack telemetry for investigations, and improve blocking of known malicious IPs. What should you implement?

Enabling Azure DDoS Protection Standard on the virtual network hosting the Application Gateway public IPs provides automatic L3/L4 DDoS mitigation specifically for those public endpoints, which is crucial for a mission-critical application. Sending DDoS diagnostics and metrics to Log Analytics allows for detailed attack telemetry and investigation, fulfilling that requirement. Configuring Azure Firewall Policy with Threat Intelligence set to Alert and Deny improves blocking of known malicious IPs by leveraging Microsoft's threat intelligence feed. Using only Azure Front Door Premium with WAF is incorrect because while Front Door offers DDoS protection, the scenario specifies an existing Application Gateway and Azure Firewall in a hub-and-spoke. NSG Flow Logs and Traffic Analytics provide network visibility but do not offer automatic DDoS mitigation. Applying DDoS IP Protection only to Azure Firewall's public IP is insufficient as the Application Gateway's public IPs also need protection. Deploying a third-party appliance is unnecessary given Azure's native capabilities and adds complexity.