Q7 — AWS SAA-C03 Ch.17

Question 7 of 89 | ← Chapter 17

Q1307. A retail company runs its application on AWS. The application uses Amazon EC2 for web servers, Amazon RDS for database services, and Amazon CloudFront for global content distribution.The company needs a solution to mitigate DDoS attacks.Which solution will meet this requirement?

• A. Implement AWS WAF custom rules to limit the length of query requests. Configure CloudFront to work with AWS WAF.
• B. Enable AWS Shield Advanced. Configure CloudFront to work with Shield Advanced. ✓
• C. Use Amazon Inspector to scan the EC2 instances. Enable Amazon GuardDuty.
• D. Enable Amazon Macie. Configure CloudFront Origin Shield.

Correct Answer: B. Enable AWS Shield Advanced. Configure CloudFront to work with Shield Advanced.

Explanation

The correct solution to mitigate DDoS attacks for the retail company's AWS-based application is:B. Enable AWS Shield Advanced. Configure CloudFront to work with Shield Advanced.Explanation:AWS Shield Advanced is a managed DDoS protection service designed to safeguard applications running on AWS against sophisticated DDoS attacks. It provides:Automatic DDoS mitigation for all AWS resources (including EC2, RDS, and CloudFront). Enhanced protection for high-risk applications (e.g., e-commerce sites) with 24/7 access to the AWS DDoS Response Team (DRT).Integration with CloudFront (and other AWS services like ALB, ELB, and Route 53) to provide global protection against Layer 3/4 (network/transport) and Layer 7 (application) attacks. Detailed attack visibility and reporting via AWS Shield Advanced dashboards.Why not the other options?A. AWS WAF + CloudFront (limited DDoS protection):AWS WAF helps block SQL injection, XSS, and other web exploits but is not a dedicated DDoS solution. While it can limit request sizes (useful for some Layer 7 attacks), it does not provide comprehensive DDoS mitigation like AWS Shield Advanced.C. Amazon Inspector + GuardDuty (security scanning, not DDoS):Amazon Inspector scans EC2 instances for vulnerabilities.GuardDuty detects malicious activity (e.g., compromised instances, API abuse) but does not mitigate DDoS attacks.D. Amazon Macie + CloudFront Origin Shield (data protection, not DDoS):Macie identifies sensitive data (e.g., PII) in S3.Origin Shield reduces CloudFront origin requests but does not protect against DDoS.Conclusion:For DDoS mitigation, AWS Shield Advanced is the best choice because it provides automated, scalable protection against large-scale attacks while integrating seamlessly with CloudFront and other AWS services.Final Answer: B