AWS Shield Advanced for DDoS Protection

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

C Subscribe to AWS Shield Advanced and engage the AWS DDoS Response Team to mitigate DDoS attacks on the ALB.

Question

A city has deployed a web application running on Amazon EC2 instances behind an Application Load Balancer (ALB). The application's users have reported sporadic performance, which appears to be related to DDoS attacks originating from random IP addresses. The city needs a solution that requires minimal configuration changes and provides an audit trail for the DDoS sources. Which solution meets these requirements?
  1. Enable an AWS WAF web ACL on the ALB, and configure rules to block traffic from unknown sources.
  2. Subscribe to Amazon Inspector. Engage the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service.
  3. Subscribe to AWS Shield Advanced. Engage the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service. Correct Answer
  4. Create an Amazon CloudFront distribution for the application, and set the ALB as the origin. Enable an AWS WAF web ACL on the distribution, and configure rules to block traffic from unknown sources

Key Takeaways

This question tests knowledge of DDoS mitigation services, specifically distinguishing between WAF (application layer) and Shield (infrastructure layer), with the trap being the assumption that WAF can handle random IP-based volumetric attacks.

AWS Shield Advanced is the correct solution for mitigating DDoS attacks with minimal configuration and audit trails. It provides managed protection against volumetric and protocol attacks via the AWS DDoS Response Team.

Common mistake: Many candidates choose Option A or D because they associate web security with AWS WAF. However, WAF rules rely on specific criteria (like IPs or patterns) which are ineffective against random IP DDoS attacks, and WAF alone does not provide the deep infrastructure protection or DRT engagement included in Shield Advanced.

Expert Analysis

Why the Answer Is Correct

AWS Shield Advanced is designed to protect against large-scale Distributed Denial of Service (DDoS) attacks that target resources such as EC2 instances behind an Application Load Balancer (ALB). It automatically detects and mitigates most common network and transport layer attacks without requiring complex configuration changes. Crucially, it includes access to the AWS DDoS Response Team (DRT), which assists in incident response and helps integrate mitigating controls, satisfying the requirement for an audit trail and expert support.

Why the Other Options Are Wrong

Option A and D suggest using AWS WAF. While WAF protects against application-layer attacks (Layer 7), it is not primarily designed for volumetric Layer 3/4 DDoS attacks originating from random IPs. Configuring rules to block 'unknown sources' is impractical and ineffective against sophisticated DDoS campaigns. Option B mentions Amazon Inspector, which is a vulnerability management service for finding software vulnerabilities, not a DDoS mitigation service. Engaging the DRT is tied to Shield Advanced, not Inspector.

Community Comment Notes

The community consensus strongly supports Option C. As Naveena_Devanga noted, "Amazon Inspector is an automated vulnerability management service whereas AWS Shield Advanced is a managed service that helps you protect your application against external threats." Another commenter, NSA_Poker, correctly pointed out that WAF Web ACLs are insufficient because "We don't have the inspection criteria necessary to use WAF Web ACL effectively bc DDoS attacks are originating from random IP addresses."

Exam Strategy

When a question mentions 'DDoS', 'volumetric attacks', or 'random IPs' targeting infrastructure like ALBs or CloudFront, think AWS Shield. Reserve AWS WAF for questions about blocking specific malicious requests, SQL injection, or bot traffic based on defined rules.

Frequently Asked Questions

Why can't I use AWS WAF to block random IP DDoS attacks?

WAF operates at Layer 7 and requires specific rule criteria. Blocking 'unknown' random IPs is impossible without blackholing all traffic, making it unsuitable for volumetric DDoS defense.

Does AWS Shield Advanced require significant configuration?

No, Shield Advanced provides automatic mitigation for common attacks. It integrates seamlessly with ALBs and CloudFront with minimal setup, unlike custom firewall rules.

More SAA-C03 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. Naveena_Devanga 👍 2
    C is the correct answer. Amazon Inspector is an automated vulnerability management service whereas AWS Shield Advanced is a managed service that helps you protect your application against external threats, like DDoS attacks, volumetric bots, and vulnerability exploitation attempts. For higher levels of protection against attacks.
  2. NSA_Poker 👍 1 Answered C
    (A & D) are incorrect. AWS WAF Web ACL - contain WAF rules that define how to inspect web requests and what to do when a web request matches the inspection criteria. We don't have the inspection criteria necessary to use WAF Web ACL effectively bc DDoS attacks are originating from random IP addresses. The AWS DDoS Response Team can respond to the randomness. (B) is incorrect. Amazon Inspector - a service that analyzes your EC2 instances to identify potential security and configuration issues. Inspector is not good at dealing with an actual DDOS attack like AWS Shield Advanced.
  3. Mikado211 👍 1 Answered C
    C is the correct answer, AWS Shield Advanced.
  4. Andy_09 👍 7
    C is the correct answer
  5. sandordini 👍 2 Answered C
    DDoS = AWS Shield
Show 2 more comments
  1. asdfcdsxdfc 👍 1 Answered C
    C looks correct
  2. Scheldon 👍 1 Answered C
    AnswerC

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide