An internet-facing app needs protection from large DDoS events WITH 24/7 access to AWS's DDoS Response Team and cost protection for scaling during attacks. What provides this?
A.AWS Shield Standard
Standard is free baseline — no DRT, no cost protection.
B.AWS Shield Advanced on the CloudFront/ALB/Route53 resources
Correct. DRT + reporting + scaling cost protection.
C.AWS WAF alone
WAF is L7 app filtering — not volumetric DDoS protection.
D.Network ACL rate limits
NACLs have no rate limiting.
Why this answer
Shield Advanced adds: 24/7 DDoS Response Team (DRT), visibility/reporting, and cost protection (credits for scaling during an attack) — beyond Standard's automatic L3/L4 baseline protection that's free on all AWS resources. WAF handles L7; NACLs can't rate-limit.
Correct answer: B · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Infrastructure Security practice session.
Practice Infrastructure Security