ANS-C01 Network Design Practice Question
A company is designing a network for a large-scale e-commerce platform that must handle sudden traffic spikes. The architecture uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances across multiple Availability Zones. The ALB is internet-facing. To protect against DDoS attacks, which AWS services should be used at the network edge?
⚠ Common exam trap
It's easy for candidates to assume AWS Shield Standard is sufficient for all DDoS protection, but the exam tests that Shield Advanced is required for application-layer attacks and cost protection, while WAF is needed for granular traffic filtering at the ALB.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Subscribe to AWS Shield Advanced and deploy AWS WAF on the ALB.
AWS Shield Advanced provides enhanced DDoS protection for internet-facing resources like ALBs, including cost protection and access to the DDoS Response Team (DRT). Deploying AWS WAF on the ALB allows you to create custom rules to filter malicious traffic, such as SQL injection or cross-site scripting attempts, and rate-limit requests to mitigate application-layer DDoS attacks. Together, they form a layered defense at the network edge, addressing both infrastructure (Layer 3/4) and application (Layer 7) threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Subscribe to AWS Shield Advanced and deploy AWS WAF on the ALB.
Why this is correct
Shield Advanced provides DDoS protection at the edge, and WAF filters application-layer attacks.
- ✗
Configure network ACLs to allow only known IP ranges.
Why it's wrong here
Network ACLs are not effective against DDoS at the edge; they are per-subnet and static.
- ✗
Enable AWS Shield Standard and configure security groups to block traffic from suspicious sources.
Why it's wrong here
Shield Standard is included, but security groups are not sufficient for DDoS.
- ✗
Use Amazon Route 53 with DNS-based failover to redirect traffic away from the ALB during an attack.
Why it's wrong here
Route 53 is not a DDoS mitigation service at the edge.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.