A company is worried about potential DDoS attacks. The company has a web application that runs on Amazon EC2 instances. The application uses Amazon S3 to serve static content such as images and…

Question

Options

• ACreate an Amazon CloudWatch alarm that invokes an AWS Lambda function when an EC2
• BPut the EC2 instances into an Auto Scaling group behind an Elastic Load Balancing (ELB) load
• CSet up a warm standby disaster recovery (DR) environment. Fail over to the warm standby DR
• DSubscribe to AWS Shield Advanced. Configure permissions to allow the Shield Response Team

• A
  14% (6)
• B
  24% (10)
• C
  5% (2)
• D
  57% (24)

Explanation

AWS Shield Advanced is purpose-built for DDoS protection - it provides always-on detection, automatic mitigations for Layer 3/4/7 attacks, and critically, includes cost protection that credits you for scaling charges incurred during a DDoS attack, making it genuinely cost-effective despite the upfront subscription fee. Allowing the Shield Response Team (SRT) access means AWS experts can actively engage during an attack on your behalf.

Option A (CloudWatch + Lambda) is reactive and offers no actual DDoS mitigation - Lambda functions can't absorb or block volumetric attacks at network scale.

Option B (Auto Scaling + ELB) improves availability but is a cost trap during DDoS: you'd pay to scale out for every malicious request, with no attack mitigation - potentially a massive unprotected bill.

Option C (Warm standby DR) is a business continuity strategy, not a DDoS defense - attackers can simply target the failover environment too, and maintaining a parallel environment is expensive.

Memory tip: Think of it this way - Auto Scaling absorbs attacks (you pay), Shield Advanced stops attacks (AWS pays you back). For DDoS specifically, the one with "Shield" in the name wins.

No community discussion yet for this question.