Hi,
Yes, your understanding is correct.
Azure DDoS Infrastructure-level protection is enabled by default and is free. There is no option to configure it.
You may choose a paid tier of Azure DDoS Protection, of which there are two:
Azure DDoS Network Protection which is $2,944/month and covers up to 100 Public IP Addresses
Azure DDoS IP Protection which is $199/month per protected public IP resource. Typically people choose this when they only have small number of public IPs they need to protect and want to save on monthly cost.
Azure DDoS Protection pricing
https://azure.microsoft.com/en-us/pricing/details/ddos-protection/
-TP