Question

A company runs a global web application behind an Application Load Balancer that is protected by AWS Shield Advanced. During a recent volumetric attack, the Shield Response Team (SRT) reported that Shield's automatic mitigations were sometimes triggered late, occasionally causing brief availability impact before mitigation engaged. The security team wants Shield Advanced to react faster and more accurately by incorporating the actual health of the protected application into its detection and mitigation decisions. Which action best achieves this?

Accepted Answer

Associate a Route 53 health check with the protected resource and enable health-based detection in Shield Advanced.

Answer

Enable AWS WAF rate-based rules on the ALB so that Shield Advanced can use the rule counters to trigger mitigations sooner.

Answer

Configure a CloudWatch alarm on ALB request count and grant Shield Advanced permission to read it for detection tuning.

Answer

Move the application behind CloudFront so Shield Advanced can apply mitigations at the edge instead of at the ALB.