AWS Shield Advanced vs Standard: DDoS Protection with Cost Protection and DRT Access
An e-commerce company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer and Amazon CloudFront. The application has been experiencing frequent, large-scale DDoS attacks that cause significant compute and data transfer costs. The company wants to implement a managed DDoS protection service that provides financial protection against scaling costs incurred during DDoS attacks, access to a DDoS Response Team (DRT) for real-time attack mitigation support, and integration with AWS WAF for application-layer attack protection. Which AWS service should the company use to meet these requirements?
Quick Answer
The answer is AWS Shield Advanced. This is the correct choice because it delivers enhanced DDoS protection with cost protection, meaning AWS will reimburse the scaling costs for EC2, ELB, CloudFront, and Route 53 that spike during an attack, while also providing 24/7 access to the DDoS Response Team (DRT) for real-time mitigation and native integration with AWS WAF for application-layer defense. On the AWS Certified Cloud Practitioner CLF-C02 exam, this question tests your ability to distinguish between Shield Standard (free, basic protection) and Shield Advanced (paid, with cost protection and DRT access). A common trap is selecting AWS WAF alone, but WAF handles only layer 7 rules and lacks the financial safeguards and expert response team. Remember the three pillars of Shield Advanced: cost protection, DRT access, and WAF integration. For a memory tip, think "Advanced = All three: cost, response, and WAF."
⚠ Common exam trap
Watch out — candidates often confuse AWS Shield Standard (free, basic protection) with AWS Shield Advanced (paid, enhanced protection with cost protection and DRT access), or mistakenly think AWS WAF alone provides DDoS mitigation and financial safeguards, when in fact WAF is only an application-layer component that must be paired with Shield Advanced for the full solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Shield Advanced
AWS Shield Advanced is the correct choice because it provides enhanced DDoS protection with financial protection against scaling costs incurred during DDoS attacks (cost protection for EC2, ELB, CloudFront, and Route 53), 24/7 access to the DDoS Response Team (DRT) for real-time attack mitigation, and seamless integration with AWS WAF for application-layer attack protection. This fully managed service meets all three stated requirements, unlike the other options.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Shield Standard
Why it's wrong here
AWS Shield Standard is automatically enabled for all AWS customers at no cost. It provides basic protection against common DDoS attacks but does not offer financial protection against scaling costs, access to the DDoS Response Team (DRT), or integration with AWS WAF for advanced application-layer protection.
When this WOULD be correct
A company needs basic, always-on DDoS protection for its web applications without additional cost or the need for advanced features like cost protection, DRT access, or WAF integration. The question would specify that the company has a limited budget and only requires baseline DDoS mitigation.
- ✓
AWS Shield Advanced
Why this is correct
AWS Shield Advanced is a paid service that provides enhanced DDoS protection. It includes cost protection against scaling charges incurred during a DDoS attack, 24/7 access to the DDoS Response Team (DRT) for expert support, and integration with AWS WAF for application-layer attack mitigation. This matches all the requirements described in the scenario.
- ✗
AWS WAF
Why it's wrong here
AWS WAF is a web application firewall that protects against common web exploits like SQL injection and cross-site scripting. While it can be integrated with Shield Advanced for application-layer protection, WAF alone does not provide DDoS protection at the network/transport layer, financial protection against scaling costs, or access to the DDoS Response Team (DRT).
When this WOULD be correct
AWS WAF would be the correct answer if the question asked for a service to create custom rules to block specific web requests (e.g., SQL injection or cross-site scripting) at the application layer, without requiring DDoS cost protection or DRT access. For example: 'A company needs to filter HTTP requests to block malicious patterns like SQL injection. Which AWS service should they use?'
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It can detect DDoS activity as a signal but does not mitigate DDoS attacks, provide financial protection, or include access to a DRT. It is a detection tool, not a mitigation service.
When this WOULD be correct
A company wants to continuously monitor AWS accounts and workloads for malicious activity and unauthorized behavior, using machine learning and threat intelligence, without needing DDoS mitigation or financial protection.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Shield AdvancedCorrect answer▾
Why this is correct
AWS Shield Advanced is a paid service that provides enhanced DDoS protection. It includes cost protection against scaling charges incurred during a DDoS attack, 24/7 access to the DDoS Response Team (DRT) for expert support, and integration with AWS WAF for application-layer attack mitigation. This matches all the requirements described in the scenario.
✗AWS Shield StandardWrong answer — click to see why▾
Why this is wrong here
AWS Shield Standard provides basic DDoS protection but does not offer financial protection against scaling costs, access to the DDoS Response Team (DRT), or integration with AWS WAF for application-layer attack protection.
★ When this WOULD be the correct answer
A company needs basic, always-on DDoS protection for its web applications without additional cost or the need for advanced features like cost protection, DRT access, or WAF integration. The question would specify that the company has a limited budget and only requires baseline DDoS mitigation.
Why candidates choose this
Candidates may confuse Shield Standard with Shield Advanced because both are DDoS protection services, and they might assume Standard includes the advanced features mentioned in the question.
✗AWS WAFWrong answer — click to see why▾
Why this is wrong here
AWS WAF is a web application firewall that protects against application-layer attacks, but it does not provide financial protection against scaling costs incurred during DDoS attacks or access to a DDoS Response Team (DRT). The question requires a managed DDoS protection service with these specific features, which are only offered by AWS Shield Advanced.
★ When this WOULD be the correct answer
AWS WAF would be the correct answer if the question asked for a service to create custom rules to block specific web requests (e.g., SQL injection or cross-site scripting) at the application layer, without requiring DDoS cost protection or DRT access. For example: 'A company needs to filter HTTP requests to block malicious patterns like SQL injection. Which AWS service should they use?'
Why candidates choose this
Candidates may choose AWS WAF because the question mentions 'application-layer attack protection' and integration with AWS WAF, leading them to mistakenly believe WAF alone meets all requirements, including DDoS cost protection and DRT access.
✗Amazon GuardDutyWrong answer — click to see why▾
Why this is wrong here
Amazon GuardDuty is a threat detection service that identifies malicious activity, but it does not provide DDoS mitigation, financial protection against scaling costs, or access to a DDoS Response Team (DRT).
★ When this WOULD be the correct answer
A company wants to continuously monitor AWS accounts and workloads for malicious activity and unauthorized behavior, using machine learning and threat intelligence, without needing DDoS mitigation or financial protection.
Why candidates choose this
Candidates may confuse GuardDuty's threat detection capabilities with DDoS protection, assuming it can also mitigate attacks, or they may think it integrates with AWS WAF for application-layer protection.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company hosts a public-facing web application on Amazon EC2 instances behind an Application Load Balancer. The security team has noticed an increase in volumetric distributed denial-of-service (DDoS) attacks targeting the application's IP address. The company wants a managed AWS service that provides automatic, always-on protection against common network-layer DDoS attacks at no additional cost. Which AWS service should the company use?
medium- A.AWS WAF
- ✓ B.AWS Shield Standard
- C.AWS Shield Advanced
- D.AWS Network Firewall
Why B: AWS Shield Standard is the correct choice because it provides automatic, always-on protection against common network-layer (Layer 3/4) DDoS attacks, such as SYN floods and UDP reflection attacks, at no additional cost. It is integrated with Elastic Load Balancing (ELB), Amazon CloudFront, and Amazon Route 53, making it ideal for protecting a public-facing web application behind an Application Load Balancer without requiring any configuration or extra fees.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.