SAA-C03 Practice Question 82: Shield Advanced DDoS
AWS Certified Solutions Architect – Associate (SAA-C03) · Test 9 · question 2 of 10
A ticketing company runs its site behind CloudFront and an Application Load Balancer. It is repeatedly targeted by large distributed denial-of-service attacks around high-profile on-sale events. The security team has no in-house DDoS specialists and wants to be able to escalate to AWS experts during an attack, and it wants the standard AWS WAF charges for the protected resources covered rather than billed separately during these events.
What should the company do?
Show answer and explanation
Answer:
Shield Advanced is the managed service for exactly this profile of risk. Subscribing and adding resources gives those resources expanded DDoS attack protection beyond what is on by default, and the service is built around escalating to expert help when you need it, which is what a team with no DDoS specialists is buying. It also covers the standard AWS WAF costs for Shield-protected resources: the cost per web ACL, per rule, and the base price per million requests for web request inspection, which is the billing behaviour described in the question.
Option B is already in place. Shield Standard is enabled for every customer at no charge, and it is what the company is being attacked through today; it offers no expert escalation path and does not cover AWS WAF charges.
Option C protects traffic at a VPC's perimeter. CloudFront and an Application Load Balancer sit in front of the VPC, so the attack is largely absorbed or dropped before Network Firewall would see it, and manually chasing attacker source addresses is precisely the specialist work the team says it cannot do.
Option D improves global routing and gives static anycast addresses, and it does put traffic on the AWS edge network sooner. It is not a DDoS response service, though: there is no expert escalation, no WAF cost coverage, and no attack-specific mitigation configuration.
Reference: AWS Shield Advanced overview