A payments provider runs a revenue-critical public API behind Application Load Balancers and Amazon CloudFront across several accounts in its organisation. The business requires guaranteed access to AWS experts during a large volumetric DDoS event, protection against the cost of scaling triggered by attack traffic, and a single managed service rather than self-built mitigation. The team wants the option that meets these resilience and financial requirements with the least operational overhead. Which approach BEST satisfies them?
- ARely on the always-on AWS Shield Standard protection included with CloudFront and the load balancers, and add Amazon CloudWatch alarms on request and byte counts so the team can scale capacity manually and open a standard support case once an attack begins.
- BSubscribe to AWS Shield Advanced, add the protected CloudFront distributions and load balancers to a protection group, and use its access to the Shield response team and DDoS cost-protection credits to handle large attacks without self-built mitigation. Correct
- CProvision AWS Network Firewall in a centralised inspection VPC, route all ingress through it with stateful rules that drop suspected DDoS source ranges, and staff an on-call rota so engineers can update the rule groups while a volumetric attack is in progress.
- DDeploy a third-party scrubbing appliance on EC2 in an Auto Scaling group ahead of the load balancers, peer it into each account, and contract the vendor for emergency support so traffic is cleaned before it reaches the application during an attack.
Why A is wrong: Shield Standard does absorb common network floods at no extra charge, but it offers no response-team engagement, no DDoS cost protection, and leaves the team scaling and escalating manually during an attack, missing the guaranteed-support and financial requirements.
Why B is correct: Shield Advanced provides enhanced volumetric mitigation, on-call access to the Shield response team during attacks, and cost-protection credits that refund scaling charges caused by a covered DDoS event, delivering the guaranteed support and financial protection as one managed service with little operational overhead.
Why C is wrong: Network Firewall inspects VPC traffic with stateful rules, but it sits inside the VPC rather than at the edge, gives no managed DDoS response team or cost protection, and requires the team to build and operate the very mitigation the requirement says to avoid.
Why D is wrong: A self-managed scrubbing fleet can filter attack traffic, but it adds instances to size, patch and scale, relies on a third-party rather than AWS for response, and provides no AWS DDoS cost protection, so it is higher overhead than the managed Shield Advanced path.