DDoS protection (Shield Advanced, CloudFront, Route 53): SCS-C03 study notes and practice questions

What to know for the exam

Questions in this topic describe a public application that must stay available during an attack, such as a volumetric flood, a SYN flood against a load balancer, or a spike that drives up the bill. You pick the protection that matches the attack layer and the resources involved.

Shield Standard and Shield Advanced

• Shield Standard is on for every AWS account at no extra cost. It defends against common layer 3 and layer 4 attacks, such as SYN floods and UDP reflection attacks. Its strongest edge coverage is on CloudFront, Route 53 and Global Accelerator.
• Shield Advanced is a paid subscription. It adds attack diagnostics and near real-time metrics, and it protects Elastic Load Balancing load balancers, Elastic IP addresses, CloudFront distributions, Route 53 hosted zones and Global Accelerator accelerators.
• The Shield Response Team supports Advanced customers around the clock, including during an attack, and can help with WAF rules.
• Cost protection credits charges for scaling that results from a DDoS attack on protected resources. It matters when the requirement is to stay up without an unbounded bill.
• Automatic application layer mitigation lets Shield Advanced create and manage WAF rules for an attack it detects on protected CloudFront distributions and Application Load Balancers.
• AWS Firewall Manager can deploy Shield Advanced protections across every account in an organization from one policy.
• Route 53 health checks and DNS failover move traffic to a healthy Region when an attack degrades one. The Route 53 health checks guide explains health checks and failover.

Read the AWS Shield overview for the full list of protected resource types.

How to choose

Common traps

• Assuming Standard covers request floods. It handles network and transport layer attacks. Application-level floods need WAF.
• Scaling out to absorb an attack without cost protection. The bill rises with the traffic.
• Subscribing to Shield Advanced for every small app when the requirement is met by Standard plus WAF at lower cost.
• Thinking Shield Advanced is required for WAF. WAF is billed separately and works with Standard.
• Configuring Shield Advanced one account at a time when Firewall Manager gives one policy for the organization.

Try the 1 practice question ↓