CLF-C02 Security and Compliance Practice Question
Which AWS service provides DDoS protection for all AWS customers at no additional charge and automatically protects resources at Layers 3 and 4?
⚠ Common exam trap
Watch out — candidates often confuse AWS Shield Standard (free, automatic Layer 3/4 protection) with AWS Shield Advanced (paid, enhanced protection including Layer 7 and cost coverage), or mistakenly think AWS WAF provides Layer 3/4 DDoS protection when it only operates at Layer 7.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Shield Standard
AWS Shield Standard is automatically enabled for all AWS customers at no additional cost and provides always-on detection and inline mitigation of DDoS attacks targeting Layers 3 (network) and 4 (transport) of the OSI model. It protects common AWS resources such as Amazon CloudFront, Elastic Load Balancing, and Amazon Route 53 from common infrastructure-layer attacks like SYN floods and UDP reflection attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS WAF
Why it's wrong here
AWS WAF is a web application firewall that operates at Layer 7 (the application layer) by inspecting HTTP/S requests for patterns like SQL injection or cross-site scripting. It is a paid, opt-in service that must be manually attached to resources like CloudFront, Application Load Balancer, or API Gateway, and it does not provide automatic network-layer DDoS mitigation. In contrast, AWS Shield Standard is built into AWS at no extra cost and requires no configuration, making WAF the wrong answer to a question about automatically included DDoS protection.
- ✗
AWS Shield Advanced
Why it's wrong here
AWS Shield Advanced is a premium DDoS protection service that provides enhanced detection, DDoS cost protection, and access to the AWS DDoS Response Team (DRT), but it requires a paid subscription starting at about $3,000 per month with a 12-month commitment. It is not automatically enabled for all accounts; customers must explicitly subscribe and configure it. The question asks for a service that is automatically included, which describes AWS Shield Standard, not the Advanced tier.
- ✓
AWS Shield Standard
Why this is correct
AWS Shield Standard is the correct answer because it is automatically enabled for every AWS customer at no additional charge, providing always-on detection and inline mitigation for infrastructure-layer (Layer 3 and 4) DDoS attacks such as SYN floods and UDP reflection. It protects all AWS resources, including EC2, Elastic Load Balancing, CloudFront, and Route 53, without any manual configuration or extra cost. This makes it the only option that meets the criteria of being automatically included with AWS.
- ✗
Amazon CloudFront with geo-restriction
Why it's wrong here
Amazon CloudFront with geo-restriction is a content delivery feature that allows you to block requests from specific geographic regions, but it is not a DDoS protection service. Geo-restriction may reduce certain types of traffic, but it does not detect or mitigate volumetric or application-layer DDoS attacks, and CloudFront itself is a separate service that must be explicitly configured. While CloudFront’s global edge network can absorb some attack traffic, geo-restriction alone does not provide the automatic, comprehensive protection offered by AWS Shield Standard.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.