A public API needs protection against BOTH infrastructure-layer DDoS floods AND application-layer HTTP floods with 24/7 response support. Which combination?
A.Shield Standard only
Standard covers L3/4 automatically — no L7 mitigation or response team.
B.Shield Advanced + WAF + access to the SRT (Shield Response Team)
Advanced + WAF + SRT = the full answer. Correct.
C.AWS Network Firewall
Network Firewall does L3–L7 inspection — not purpose-built DDoS response.
D.WAF alone
WAF alone handles L7 but lacks DDoS economics/response support.
Why this answer
Shield Advanced adds enhanced L3–L7 DDoS protection, cost protection, and the 24/7 Shield Response Team; WAF rules handle L7 floods (rate-based, geo-blocking). Shield Standard is L3/4 automatic baseline — no SRT, no L7 logic.
Correct answer: B · Last reviewed 2026-11-05
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security