AWS Certified Cloud Practitioner (CLF-C02)Security and ComplianceHard
A company's public web application already benefits, at no additional charge, from protection against the most common network and transport layer DDoS attacks. To gain access to the 24/7 DDoS Response Team (DRT) and cost protection for scaling during an attack, which AWS offering must the company subscribe to?
- AAWS Shield Standard, which already provides this
- BAWS WAF managed rule groups
- CAWS Shield Advanced
- DAWS Firewall Manager
Show answer & explanationAnswer & explanation
Correct answer: C. AWS Shield Advanced
AWS Shield Standard is automatically included at no cost and protects against common infrastructure-layer DDoS attacks, but 24/7 access to the DDoS Response Team and DDoS cost protection require an AWS Shield Advanced subscription, which is a paid service.
Why the other options are wrong
- A. Shield Standard is free but does not include DRT access or cost protection.
- B. WAF managed rules filter web application traffic, not DDoS-specific incident response.
- D. Firewall Manager centrally manages security policies but doesn't itself provide DRT access.
Shield Standard vs Shield Advanced
AWS Shield Standard provides free, automatic protection against common DDoS attacks; Shield Advanced is a paid tier adding DDoS Response Team access, cost protection, and advanced mitigation for larger/sophisticated attacks.
- Shield Standard: free, automatic, all AWS customers
- Shield Advanced: paid subscription with DRT support and cost protection
- Shield Advanced also integrates with WAF for enhanced application-layer mitigation
Memory trick: Standard is the free helmet, Advanced hires bodyguards