Q53 — AWS SAA-C03 Ch.17

Question 53 of 89 | ← Chapter 17

Q1353. A company wants to protect resources that the company hosts on AWS, including Application Load Balancers and Amazon CloudFront distributions. The company wants an AWS service that can provide near real-time visibility into attacks on the company's resources. The service must also have a dedicated AWS team to assist with(DDoS) attacks.Which AWS service will meet these requirements?

Correct Answer: D. AWS Shield Advanced

Explanation

The correct answer is D. AWS Shield Advanced.Explanation:The requirements are:Near real-time visibility into attacks (DDoS or other threats). Protection for Application Load Balancers (ALB) and Amazon CloudFront. Dedicated AWS team assistance during DDoS attacks (24/7 support).Why Option D (AWS Shield Advanced) is correct:AWS Shield Advanced provides:Enhanced DDoS protection for high-risk applications (e.g., ALB, CloudFront, Route 53, Elastic IPs). Near real-time attack visibility via AWS Shield Advanced dashboards and integration with Amazon CloudWatch for monitoring.24/7 access to the AWS DDoS Response Team (DRT) for expert assistance during attacks.Cost protection for bandwidth spikes due to DDoS attacks.Why the other options are incorrect:A. AWS WAFIncorrect:AWS WAF is a web application firewall that blocks malicious traffic (e.g., SQLi, XSS) but does not provide DDoS protection or dedicated attack response.No real-time visibility into DDoS attacks (only traffic filtering).B. AWS Shield StandardIncorrect:Provides automatic DDoS protection for ALB, CloudFront, and Route 53, but no real-time visibility or dedicated support.No access to the AWS DDoS Response Team.C. Amazon MacieIncorrect:Macie is a data security service that identifies sensitive data in S3 (e.g., PII) using machine learning.Not related to DDoS protection or attack visibility.Key Differences:FeatureAWS Shield StandardAWS Shield AdvancedDDoS ProtectionBasic (Layer 3/4)Enhanced (L3/4 + L7)Real-Time Attack Visibility NoYes (CloudWatch)Dedicated DRT Support NoYes (24/7)Cost Protection NoYes (for DDoS-related spikes)Applicable ServicesALB, CloudFront, Route 53ALB, CloudFront, Route 53, Elastic IPs, Global Accelerator Conclusion:AWS Shield Advanced (D) is the only service that meets all requirements:Near real-time attack visibility (via CloudWatch).Protection for ALB and CloudFront.Dedicated AWS DDoS Response Team for expert assistance.The other options either lack real-time visibility (Shield Standard, WAF) or are unrelated to DDoS protection (Macie).