A financial services company runs a public-facing web application behind an Application Load Balancer and Amazon CloudFront. After experiencing a large-scale distributed denial-of-service (DDoS) attack, leadership wants enhanced protection that includes 24/7 access to a DDoS response team and financial protection against scaling charges caused by attacks. Which AWS service should the company use?