AWS Certified Advanced Networking – Specialty (ANS-C01)Network Security, Compliance, and GovernanceMedium
A media streaming platform needs to protect its content delivery infrastructure on AWS from large-scale Distributed Denial of Service (DDoS) attacks. The platform uses Amazon CloudFront, Application Load Balancers, and EC2 instances. The solution must include advanced DDoS mitigation capabilities, 24/7 access to DDoS experts, and cost protection against scaling charges during an attack. Which AWS service is specifically designed to provide these comprehensive DDoS protections?
- AAWS Shield Advanced
- BAmazon GuardDuty
- CAWS WAF
- DAWS Shield Standard
Show answer & explanationAnswer & explanation
Correct answer: A. AWS Shield Advanced
AWS Shield Advanced provides enhanced DDoS protection for applications running on AWS, including resources like CloudFront, ALBs, and EC2. It offers always-on detection, inline mitigations, 24/7 access to the AWS DDoS Response Team (DRT), and cost protection against scaling charges incurred due to a DDoS attack, directly addressing all specified requirements.
Why the other options are wrong
- B. Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, but it does not provide active DDoS mitigation or cost protection.
- C. AWS WAF protects against common web exploits and Layer 7 attacks, but it is not specifically designed for large-scale volumetric DDoS protection or the other advanced Shield Advanced features.
- D. AWS Shield Standard provides basic, automatic DDoS protection for all AWS customers but lacks the advanced features, DRT access, and cost protection of Shield Advanced.
AWS Shield Advanced
A paid DDoS protection service that provides enhanced protections for AWS resources, including 24/7 access to the DDoS Response Team and cost protection.
- Provides always-on detection and inline mitigations against large-scale DDoS attacks.
- Offers 24/7 access to the AWS DDoS Response Team (DRT).
- Includes cost protection against scaling charges incurred during a DDoS event.
- Protects CloudFront distributions, Application Load Balancers, Elastic IP addresses, and EC2 instances.
Memory trick: Shield Advanced defends, responds, and covers costs.