AWS Certified Advanced Networking – Specialty (ANS-C01)Network Security, Compliance, and GovernanceHard
A global e-commerce platform experienced a large-scale Distributed Denial of Service (DDoS) attack that severely impacted their website availability, resulting in significant revenue loss. They need to implement a proactive, always-on DDoS protection service that automatically mitigates layer 3 and layer 4 attacks and provides advanced protection for their web applications and DNS. They also require 24/7 access to DDoS response experts. Which AWS service provides these capabilities?
- AAWS WAF
- BAmazon CloudFront
- CAWS Shield Standard
- DAWS Shield Advanced
Show answer & explanationAnswer & explanation
Correct answer: D. AWS Shield Advanced
AWS Shield Advanced provides enhanced DDoS protection for EC2, ELB, CloudFront, Global Accelerator, and Route 53. It offers always-on detection and automatic inline mitigations for L3/L4 attacks, and advanced protection for web applications. Critically, it includes 24/7 access to the AWS DDoS Response Team (DRT) for manual attack mitigation and post-attack analysis, which is a key requirement for this scenario.
Why the other options are wrong
- A. AWS WAF protects against common web exploits (L7) but does not provide comprehensive L3/L4 DDoS protection or access to a DDoS response team.
- B. Amazon CloudFront is a content delivery network (CDN) that can help absorb some traffic, but it is not a dedicated, comprehensive DDoS protection service with response team access.
- C. AWS Shield Standard provides automatic, always-on protection for all AWS customers against common, most frequent L3/L4 DDoS attacks but lacks the advanced features, higher-level protection, and access to the DRT offered by Shield Advanced.
AWS Shield Advanced
A paid, managed DDoS protection service that provides enhanced protections against larger and more sophisticated DDoS attacks, including 24/7 access to the AWS DDoS Response Team.
- Always-on detection and automatic inline mitigations for L3/L4 DDoS attacks.
- Advanced protection for web applications (L7) when integrated with WAF.
- Protects CloudFront, Route 53, ELB, EC2, Global Accelerator.
- Includes 24/7 access to AWS DDoS Response Team (DRT).
- Cost protection against scaling charges from DDoS attacks.
Memory trick: Shield Advanced is the 'elite bodyguard' with a 'special response team' for major attacks.