AWS Shield for Network Layer DDoS Protection
A company is building a web application using AWS. Which AWS service will help prevent network layer DDoS attacks against the web application?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of AWS security services by distinguishing between web application firewalls (WAF) and infrastructure-level DDoS protection (Shield).
AWS Shield is the managed Distributed Denial of Service (DDoS) protection service designed to safeguard AWS resources and applications running on AWS against network layer attacks.
Candidates often select AWS WAF, confusing web-layer (Layer 7) protection with network/transport-layer (Layer 3/4) DDoS mitigation provided by AWS Shield.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS Shield is AWS's managed DDoS protection service that automatically detects and mitigates attacks targeting Amazon EC2 instances, Elastic Load Balancers, and CloudFront distributions. It provides always-on detection and rapid response capabilities specifically at the network and transport layers (Layers 3 and 4), which aligns directly with the requirement to prevent network layer DDoS attacks.Why the Other Options Are Wrong
AWS WAF (Web Application Firewall) operates at Layer 7 and is designed to filter HTTP/HTTPS traffic based on rules like SQL injection or cross-site scripting, not raw network-layer floods. AWS Firewall Manager helps centrally manage firewall policies across accounts but does not provide the underlying DDoS mitigation engine itself. Amazon GuardDuty is a threat detection service that identifies suspicious activity and potential compromises using machine learning, but it does not actively block or mitigate DDoS attacks in real-time.Community Comment Notes
Community consensus strongly supports AWS Shield as the correct answer. As noted by user alokdixit2006, "AWS Shield to protect from DDoS attacks" is the standard association. Another commenter clarified the distinction, stating, "AWS WAF is a web application firewall... AWS Shield provides expanded DDoS attack protection," highlighting why WAF is incorrect for this specific scenario.Exam Strategy
Always differentiate between 'Web' protections (WAF, Shield Advanced for app layer) and 'Network' protections (Shield Standard/Advanced for L3/L4). If the question specifies 'network layer' or 'volumetric', think Shield first.
Frequently Asked Questions
What is the difference between AWS Shield and AWS WAF?
AWS Shield protects against DDoS attacks at the network and transport layers (L3/L4), while AWS WAF filters malicious HTTP/HTTPS traffic at the application layer (L7).
Does AWS Shield Standard cover all AWS customers?
Yes, AWS Shield Standard provides automatic protection against common network and transport layer DDoS attacks for all AWS customers at no additional cost.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →