ANS-C01 Network Security, Compliance and Governance Practice Question
A company uses AWS Shield Advanced to protect their web application against DDoS attacks. They have a CloudFront distribution and an Application Load Balancer (ALB) as origins. They want to receive notifications when a DDoS attack is detected. What is the MOST comprehensive way to set up notifications?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a CloudWatch alarm on the AWS Shield Advanced metric DDoSDetected and configure an SNS notification.
AWS Shield Advanced provides DDoSDetected metrics in CloudWatch. You can create a CloudWatch alarm on this metric and configure an SNS notification to alert when a DDoS attack is detected. Option A is incorrect because Shield Advanced does not have automatic notification settings; it relies on CloudWatch alarms. Option B is incorrect because AWS Config monitors configuration changes, not DDoS events. Option D is incorrect because Route 53 health checks monitor endpoint health, not DDoS attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Shield Advanced automatic notifications in the AWS Shield console.
Why it's wrong here
Wrong: Shield Advanced does not have built-in automatic notifications.
- ✗
Set up AWS Config rules to detect changes in the Shield Advanced configuration and send alerts.
Why it's wrong here
Wrong: Config does not detect DDoS events.
- ✓
Create a CloudWatch alarm on the AWS Shield Advanced metric DDoSDetected and configure an SNS notification.
Why this is correct
Correct: Shield Advanced metrics are sent to CloudWatch, and alarms can trigger SNS.
- ✗
Use Amazon Route 53 health checks to monitor the application and send notifications on failure.
Why it's wrong here
Wrong: Health checks monitor endpoint availability, not DDoS.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using AWS Shield Advanced to protect against DDoS attacks. They want to receive notifications when an attack is detected. Which AWS service should they integrate with to receive notifications?
medium- A.Amazon Simple Queue Service (SQS)
- B.AWS Lambda
- ✓ C.Amazon CloudWatch and Amazon Simple Notification Service (SNS)
- D.Amazon Kinesis Data Streams
Why C: AWS Shield Advanced sends metrics to CloudWatch, and you can create CloudWatch alarms to trigger SNS notifications. Option A (SQS) is for queuing. Option B (Lambda) can be triggered but SNS is simpler. Option D (Kinesis) is for streaming.
Variation 2. A company is using AWS Shield Advanced to protect against DDoS attacks. The security team wants to receive notifications when an attack is detected. Which service should be used to send these notifications?
easy- A.AWS Lambda
- B.AWS Config
- C.Amazon SQS
- ✓ D.Amazon SNS
Why D: AWS Shield Advanced integrates with Amazon CloudWatch to publish metrics and events. These events can be routed via Amazon EventBridge to trigger an Amazon SNS topic, which then sends notifications (e.g., email, SMS) to the security team. Option A (AWS Lambda) is a compute service, not a notification service. Option B (AWS Config) is used for configuration auditing and compliance, not notifications. Option C (Amazon SQS) is a message queue service; although it can receive events, it is not the service used to send direct notifications to subscribers. Only Amazon SNS (Option D) provides push-based notifications to endpoints like email, SMS, and mobile devices.
Variation 3. A company uses AWS Shield Advanced to protect its web application from DDoS attacks. The application is fronted by Amazon CloudFront and an Application Load Balancer. The security team wants to receive notifications when a DDoS attack is detected. Which AWS service should be used to receive these notifications?
hard- A.AWS Config
- ✓ B.Amazon CloudWatch
- C.VPC Flow Logs
- D.Amazon GuardDuty
Why B: AWS Shield Advanced integrates with Amazon CloudWatch to emit DDoS detection metrics. You can create a CloudWatch alarm based on these metrics (e.g., DDoSDetected) to send notifications via SNS. Option A (AWS Config) is for resource configuration auditing, not DDoS notifications. Option C (VPC Flow Logs) captures network traffic metadata but does not provide Shield-specific alerts. Option D (Amazon GuardDuty) is a threat detection service, but it does not directly provide Shield Advanced event notifications.
Variation 4. A company uses AWS Shield Advanced for DDoS protection. They want to receive near real-time notifications when a DDoS attack is detected. Which AWS service should be used to trigger the notification?
medium- A.Amazon EventBridge
- B.AWS Lambda
- C.Amazon Simple Queue Service (SQS)
- ✓ D.Amazon Simple Notification Service (SNS)
Why D: AWS Shield Advanced integrates with CloudWatch to send metrics and alarms. Shield can send events to EventBridge, but for near real-time notifications, CloudWatch Alarms are typically used to trigger SNS topics. Lambda and SQS are not direct notification services for Shield events.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.