CLF-C02 Security and Compliance Practice Question
A company is concerned about Distributed Denial of Service (DDoS) attacks against their website hosted on AWS. They want basic DDoS protection without incurring additional cost. Which AWS service provides automatic DDoS protection at no extra charge?
⚠ Common exam trap
It's easy for candidates to confuse AWS WAF (which protects against application-layer threats but is not free) with DDoS protection, or they assume Shield Advanced is the only DDoS service, overlooking the always-on, no-cost Shield Standard.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Shield Standard
AWS Shield Standard is automatically enabled for all AWS customers at no additional cost and provides basic protection against common infrastructure-layer DDoS attacks, such as SYN/UDP floods and reflection attacks. This matches the requirement for automatic, no-cost DDoS protection without any manual configuration or subscription.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS WAF
Why it's wrong here
AWS WAF is a paid web application firewall that operates at Layer 7, inspecting HTTP(S) requests based on rules you define to block threats like SQL injection or cross-site scripting. It is not automatically enabled, costs per rule and per request, and only mitigates application-layer attacks, so it does not provide the free, always-on network/transport-layer DDoS protection described in the question.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a continuous threat detection service that analyzes VPC flow logs, AWS CloudTrail events, and DNS logs to identify suspicious activity such as compromised instances, cryptocurrency mining, or known malicious IPs. It does not actively filter or absorb DDoS traffic; it operates on a separate cost model based on log volume, and while it may alert you to an attack, it does not provide real-time DDoS mitigation.
- ✗
AWS Shield Advanced
Why it's wrong here
AWS Shield Advanced is a premium DDoS protection service that requires a $3,000/month subscription and a 1-year commitment. It adds enhanced detection, 24/7 access to the DDoS Response Team, cost protection, and integration with WAF for application-layer attacks, but because it is a paid, opt-in upgrade, it cannot be the free default protection that Shield Standard already provides.
- ✓
AWS Shield Standard
Why this is correct
AWS Shield Standard is enabled by default for every AWS customer at no additional charge, protecting against the most common network and transport-layer DDoS attacks, including SYN floods, UDP floods, and reflection-based attacks. It is always on and automatically integrated with Amazon CloudFront, Route 53, and Global Accelerator, giving you a baseline level of DDoS protection without any setup or configuration.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.