A public-facing Azure application needs enhanced protection and visibility against volumetric network DDoS attacks. Which service directly targets this threat?

1. Blob soft delete
2. A private DNS zone
3. An appropriate Azure DDoS Protection offering for the exposed public IP resources
4. A WAF alone as complete volumetric network protection