Get Your CertSAP-C02PlayCompete
‹ All SAP-C02 questions

SAP-C02 Practice Question 67: Shield Advanced Application Layer DDoS

AWS Certified Solutions Architect – Professional (SAP-C02) · Test 7 · question 7 of 10

Continuous Improvementmedium

An e-commerce site runs behind a public Application Load Balancer. During promotions it suffers HTTP flood attacks that exhaust the application tier, and Shield Standard does not stop them. The security team wants layer 7 DDoS attacks to be detected and mitigated automatically with AWS WAF rules that are created for them, wants the standard AWS WAF charges for the protected resources to be covered, and wants access to AWS experts to escalate during an attack.

Which solution meets these requirements?

Select one answer
Show answer and explanation

Answer:

  • B. Subscribe to AWS Shield Advanced, protect the load balancer, and enable automatic application layer DDoS mitigation

AWS Shield Advanced *"provides expanded DDoS attack protection"* for resources that you add as protected resources, and it is designed to help you *"escalate when you need expert help."* Enabling automatic application layer DDoS mitigation adds a rule group to the protection pack (web ACL) that responds to layer 7 events, and AWS explains that *"your Shield Advanced subscription covers the costs of using standard AWS WAF capabilities for resources that you protect with Shield Advanced"* (option B).

- A is wrong because Shield Standard already applies to every account and does not provide layer 7 mitigation. Manually adding NACL rules per attacking address is slow, and floods usually come from many addresses. - C is wrong because a single rate-based rule is a static control that the team maintains, it does not create rules automatically, and reviewing logs afterward is a reactive approach. - D is wrong because scaling out absorbs an attack by paying for more capacity. It does not stop the malicious requests and raises cost.

Reference: AWS Shield Advanced overview

Practice Test 7 ›

Study guides for SAP-C02

Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
SAP-C02 vs SAP-C03, the Solutions Architect Professional updateWhat changes when AWS replaces SAP-C02 with SAP-C03, the key dates, who should still sit SAP-C02, and how to study through the switch without wasted work.
AWS disaster recovery strategies, RTO and RPOBackup and restore, pilot light, warm standby and active/active on AWS, how RTO and RPO pick between them, and the services each strategy uses.
IAM users, roles and policies on AWSHow IAM users, roles, identity-based and resource-based policies, cross-account access, SCPs and permissions boundaries fit together for AWS exams.
SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.
VPC endpoints vs NAT gateways on AWSWhen to use gateway endpoints, interface endpoints (PrivateLink) or a NAT gateway for private subnets, and the cost and security trade-offs exams test.