A service that protects Azure resources against distributed denial-of-service attacks. The Basic tier is included free for all resources; the Network Protection tier adds adaptive mitigation tuned to the application's traffic, alerts, and access to DDoS response experts.
AZ-305 asks when the cost of DDoS Network Protection over the Basic tier is justified: business-critical, internet-facing workloads that need application-specific mitigation and a cost-guarantee SLA during an attack.
Azure DDoS Protection is a concept that can show up on the exam. Check the full guide to see it in context.