// question 42
42 / 1284
Domain 1 · Design Secure Architecturesmedium
A company runs a public-facing application behind an Application Load Balancer. The security team requires that DDoS protection automatically scales and that responses to attacks are visible in a dashboard. Which combination meets the requirements with the LEAST operational overhead?
// choose the correct answer
Deploy AWS Shield Standard and enable VPC Flow Logs to a dashboard
Subscribe to AWS Shield Advanced and use the AWS WAF + Shield dashboard
Run a third-party DDoS appliance in each AZ and stream logs to CloudWatch
Use Network ACLs and a Lambda function to throttle source IPs in real time
// explanation
AWS Shield Advanced includes managed DDoS protection with automatic scaling and a dedicated attack visibility dashboard. Shield Standard alone does not provide operational dashboards for attack response. Third-party appliances and custom NACL/Lambda throttling add significantly more operational overhead.
// answer key
B// community vote4,218 votes
// by option
B
2,995 · 71%
D
759 · 18%
A
295 · 7%
C
169 · 4%
A
Alex M.Shield Advanced is the only managed option here that gives you both auto-scaling DDoS protection and a real-time attack dashboard without running appliances in every AZ.
