Question

A media company runs a high-profile streaming platform behind an Application Load Balancer, with static assets delivered via Amazon CloudFront and DNS managed in Amazon Route 53. During major live events, the platform has been targeted by large volume-based and application-layer DDoS attacks that caused outages. The company wants comprehensive DDoS protection, access to a 24/7 DDoS response team, and financial protection against scaling charges caused by attacks. Which solution best meets these requirements?

Accepted Answer

Enable AWS Shield Advanced and associate it with the CloudFront distribution, Application Load Balancer, and Route 53 hosted zone.

Answer

Rely on the default AWS Shield Standard protection that is automatically applied to all AWS accounts at no additional cost.

Answer

Deploy AWS WAF with rate-based rules on the Application Load Balancer and configure GuardDuty to detect anomalous traffic.

Answer

Configure network ACLs and security groups on the VPC subnets to block traffic from IP ranges identified during previous attacks.