Which AWS service automatically protects resources such as CloudFront distributions and Elastic Load Balancers against common network and transport layer (layer 3/4) DDoS attacks at no additional cost?
A.AWS Shield Standard
Correct. Shield Standard provides automatic, free L3/L4 DDoS mitigation.
B.Amazon Macie
Macie discovers sensitive data in S3; it is not a DDoS service.
C.AWS Artifact
Artifact provides compliance reports, not network protection.
D.Amazon Detective
Detective helps investigate security findings; it does not mitigate attacks.
Why this answer
AWS Shield Standard is enabled automatically at no cost and protects against common layer 3 and layer 4 DDoS attacks. Shield Advanced adds costlier protections and response support for a fee.
Correct answer: A · Last reviewed 2026-10-25
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security