AWS Shield Advanced for DDoS Protection

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

D Subscribe to AWS Shield Advanced and configure hosted zones in Route 53. Add ALB resources as protected resources.

Question

A company is building an application in the AWS Cloud. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 for the DNS. The company needs a managed solution with proactive engagement to detect against DDoS attacks. Which solution will meet these requirements?
  1. Enable AWS Config. Configure an AWS Config managed rule that detects DDoS attacks.
  2. Enable AWS WAF on the ALCreate an AWS WAF web ACL with rules to detect and prevent DDoS attacks. Associate the web ACL with the ALB.
  3. Store the ALB access logs in an Amazon S3 bucket. Configure Amazon GuardDuty to detect and take automated preventative actions for DDoS attacks.
  4. Subscribe to AWS Shield Advanced. Configure hosted zones in Route 53. Add ALB resources as protected resources. Correct Answer

Key Takeaways

The question tests the distinction between WAF (application layer) and Shield (infrastructure layer). The common trap is selecting WAF, which handles web exploits but not volumetric DDoS attacks.

This question evaluates the correct managed service for proactive DDoS detection and mitigation in AWS. The page establishes that AWS Shield Advanced is the required solution for comprehensive, proactive protection.

Common mistake: Candidates often select AWS WAF because it protects ALBs, confusing web application threats like SQL injection with network-level DDoS attacks.

Expert Analysis

Why the Answer Is Correct

AWS Shield Advanced is the managed DDoS protection service designed specifically to detect and mitigate large-scale distributed denial-of-service attacks. It provides proactive engagement and integration with AWS WAF to automatically create rules when an attack is detected. By associating Route 53 hosted zones and ALB resources with Shield Advanced, the company gains access to 24/7 DDoS response team support and cost protection.

Why the Other Options Are Wrong

Option A is incorrect because AWS Config is a compliance auditing tool, not a real-time security defense mechanism. Option B is incorrect because AWS WAF primarily protects against web exploitation vulnerabilities like SQL injection and XSS, rather than volumetric DDoS attacks. Option C is incorrect because GuardDuty is a threat detection service that alerts on suspicious activity but does not actively block or mitigate DDoS traffic without additional complex integrations.

Community Comment Notes

Community consensus strongly supports option D, highlighting the fundamental difference between Shield and WAF. As noted by user dhewa, "DDoS = Shield, SQL injection = WAF" serves as a reliable mnemonic. User LeonSauveterre further clarified that Shield Standard covers common attacks while Shield Advanced offers the proactive engagement required here.

Official Reference

https://aws.amazon.com/shield/

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always distinguish between infrastructure-layer protection (Shield) and application-layer protection (WAF). When a question mentions 'proactive engagement' or 'DDoS', think Shield Advanced immediately.

Frequently Asked Questions

Why is AWS WAF not sufficient for DDoS?

WAF focuses on web application layer threats like SQL injection, whereas DDoS attacks overwhelm infrastructure capacity, requiring Shield.

Does Shield Advanced integrate with Route 53?

Yes, Shield Advanced can protect Route 53 DNS records to prevent DNS-based DDoS attacks alongside EC2 and ALB resources.

More SAA-C03 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. dhewa 👍 4 Answered D
    Tip: DDoS = Shield, SQL injection = WAF
  2. LeonSauveterre 👍 2 Answered D
    For your references: 1. AWS WAF (Web Application Firewall) - SQL injections, cross-site scripting (XSS), and other common web exploits. 2. Shield Standard - common DDoS attacks; Shield Advanced - Provides advanced DDoS protection with 24/7 support, cost protection for scaling due to attacks, and more detailed attack analytics. 3. AWS Network Firewall - Blocks unauthorized access and inspect traffic for VPCs. 4. Amazon GuardDuty - Detects threats by analyzing AWS logs like CloudTrail, DNS, and VPC Flow Logs. Identifies potential malicious activities like brute force attacks and data exfiltration. 5. AWS Macie - Helps identify and protect sensitive data like PII stored in S3 buckets.
  3. AMEJack 👍 2 Answered D
    Shield Advanced signals a DDoS detection and starts analyzing the traffic for an attack signature. If a signature is found, it is first tested on past traffic to reduce the risk of false positive, then if it's safe to use it, a corresponding WAF rule is placed in the previously created rule group. After a certain time, when the attack is stopped, the rule is automatically removed from the rule group. When successful, this process takes several minutes.
  4. swati1508 👍 2
    D for DDOS shield advance
  5. komorebi 👍 2 Answered D
    Answer is D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide