AWS Certified Cloud Practitioner (CLF-C02)Security and ComplianceHard
A company running a globally distributed e-commerce site is repeatedly targeted by large-scale volumetric DDoS attacks and needs proactive DDoS response support along with cost protection for scaling charges incurred during attacks. Which service tier should they subscribe to?
- AAmazon GuardDuty with S3 protection enabled
- BAWS WAF managed rule groups
- CAWS Shield Standard
- DAWS Shield Advanced
Show answer & explanationAnswer & explanation
Correct answer: D. AWS Shield Advanced
AWS Shield Advanced provides enhanced DDoS protection, 24/7 access to the AWS DDoS Response Team (DRT), and cost protection against scaling charges resulting from DDoS attacks, whereas Shield Standard offers only basic automatic protection with no DRT access or cost protection.
Why the other options are wrong
- A. GuardDuty detects threats via log analysis; it does not provide DDoS response or billing protection.
- B. WAF managed rule groups filter application-layer traffic but do not provide DDoS cost protection.
- C. Shield Standard is free and automatic but lacks DRT access and cost protection for scaling charges.
AWS Shield Advanced
A paid DDoS protection service offering enhanced detection, 24/7 DDoS Response Team access, and cost protection against attack-related scaling charges.
- Shield Standard is free and automatically enabled for all AWS customers
- Shield Advanced requires a subscription with a 1-year commitment
- Provides cost protection for scaling charges due to DDoS attacks on protected resources
Memory trick: Standard is the free shield; Advanced brings a DDoS SWAT team.