A company's cloud environment includes Amazon EC2 instances and Application Load Balancers. The company wants to improve protections for its cloud resources against DDoS attacks. The company also…

Question

Options

• AAWS Shield Standard
• BAWS Firewall Manager
• CAWS Shield Advanced
• DAmazon GuardDuty

• A
  3% (1)
• C
  93% (28)
• D
  3% (1)

Explanation

AWS Shield Advanced (C) is correct because it provides enhanced DDoS protection specifically for resources like EC2 instances and Application Load Balancers, and critically, it includes real-time attack visibility through the AWS Management Console and integration with CloudWatch metrics - both requirements the question demands.

Why the distractors fail:

• A (Shield Standard) is automatically included for all AWS customers at no cost, but it only protects against common, well-known DDoS attacks and provides no real-time visibility or attack diagnostics.
• B (Firewall Manager) is a centralized firewall policy management tool - it helps deploy WAF rules and Shield protections across accounts, but is not itself a DDoS protection service.
• D (GuardDuty) is a threat detection service focused on malicious activity and anomalies (like unauthorized access or crypto-mining), not DDoS mitigation.

Memory tip: Think "Advanced = Visibility + Active Protection." Any exam question that mentions real-time DDoS visibility, DDoS response team (DRT) access, or cost protection during attacks is pointing to Shield Advanced - Standard gives you basic protection silently in the background, but Advanced gives you the dashboard and the details.

No community discussion yet for this question.