Is there an additional cost for DDoS protection?

Baseline 20 Gbit/s is free. Advanced L7 DDoS filtering starts at $29/mo per IP.