A company running a website behind CloudFront wants protection against common network and transport layer DDoS attacks automatically included at no extra charge. Separately, its finance team wants a paid service that provides DDoS-related cost protection against scaling charges and access to 24/7 specialist support during a large, sustained attack. Which pairing correctly matches AWS's DDoS-related offerings to these two needs respectively?
- AWS Shield Standard automatically protects all AWS customers at no extra charge against common layer 3/4 DDoS attacks; AWS Shield Advanced is the paid tier that adds DDoS cost protection and access to the AWS DDoS Response Team
- AWS Shield Advanced is included automatically for every AWS customer; AWS Shield Standard is the paid upgrade that adds the DDoS Response Team
- AWS WAF provides the automatic free protection; AWS Shield Standard is the paid tier that adds cost protection
- Amazon CloudFront has no DDoS protection at all unless AWS Shield is purchased and separately enabled on every distribution
Why A? And why not the others?
Correct answer: A. AWS Shield Standard automatically protects all AWS customers at no extra charge against common layer 3/4 DDoS attacks; AWS Shield Advanced is the paid tier that adds DDoS cost protection and access to the AWS DDoS Response Team
AWS Shield Standard is automatically included for every AWS customer at no additional charge and protects services like CloudFront and Route 53 against common, most-frequently-occurring network and transport layer (layer 3/4) DDoS attacks; AWS Shield Advanced is an optional paid subscription that adds DDoS cost protection against scaling charges incurred during an attack, more detailed attack visibility, and 24/7 access to the AWS DDoS Response Team. The option reversing which tier is free and which is paid is wrong because it inverts the actual roles: Shield Standard, not Advanced, is the automatic free baseline, and Shield Advanced, not Standard, is the paid upgrade with the Response Team. The option substituting AWS WAF for the automatic free protection is wrong because WAF is a separate, rule-based layer 7 filtering service that customers configure themselves; it is not the automatic infrastructure-level DDoS protection that Shield Standard provides, and it additionally mislabels which Shield tier is paid. The option claiming CloudFront has no DDoS protection unless purchased separately is wrong because Shield Standard's protection for CloudFront distributions is automatic and requires no purchase or separate enablement at all.
Source: AWS Shield documentation: AWS Shield Standard vs. AWS Shield Advanced