To protect your Application Load Balancer from a sophisticated L7 DDoS attack that uses a massive number of varied IP addresses to mimic real users (Layer 7 flooding), which AWS service should you use?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: AWS Shield Advanced

AWS Shield Advanced provides advanced DDoS protection and includes access to the Shield Response Team (SRT), which can help create custom WAF rules to mitigate sophisticated L7 att...

📋Part of AWS Certified Solutions Architect – Professional (SAP-C02) · AWS Certification Practice
Real Exam ScenarioAmazon CloudFront

To protect your Application Load Balancer from a sophisticated L7 DDoS attack that uses a massive number of varied IP addresses to mimic real users (Layer 7 flooding), which AWS service should you use?

✓ Correct Answer & ExplanationAmazon CloudFront

Correct Answer

AWS Shield Advanced

Why This Answer Is Correct

AWS Shield Advanced provides advanced DDoS protection and includes access to the Shield Response Team (SRT), which can help create custom WAF rules to mitigate sophisticated L7 attacks.

📚 What This Question Tests

This question evaluates your knowledge of Amazon CloudFront — a core concept tested in AWS Certified Solutions Architect – Professional (SAP-C02). Understanding Amazon CloudFront is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.