Quick Answer
The answer is Amazon CloudFront, AWS Shield, and AWS WAF. CloudFront serves as a global content delivery network that caches static content at edge locations, drastically reducing latency for users worldwide by bringing data closer to them. AWS Shield Standard, included automatically with CloudFront, provides always-on detection and inline mitigation against common Layer 3 and Layer 4 DDoS attacks, ensuring availability without added cost or configuration. On the SAP-C02 exam, this trio tests your ability to architect for both performance and security at scale, often appearing in scenario-based questions where a single service like CloudFront alone is a trap—it handles caching but not application-layer threats. The key insight is that CloudFront improves latency for static content, Shield defends against volumetric DDoS, and WAF blocks Layer 7 attacks like SQL injection. Memory tip: think “CDN + Shield + WAF” as the three pillars for global, low-latency, and protected delivery.
This SAP-C02 practice question tests your understanding of design for new solutions. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is designing a new web application with a global user base. They need to improve latency for static content and protect against DDoS attacks. Which services should they use? (Choose THREE.)
AWS Shield
DDoS protection.
AWS Global Accelerator
Why wrong: Improves latency for TCP/UDP traffic, but not for static content and DDoS.
Amazon Route 53
Why wrong: DNS service, not for content delivery or DDoS.
AWS WAF
Web application firewall to filter traffic.
Amazon CloudFront
CDN for low-latency content delivery.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
AWS Shield
AWS Shield (Standard, included by default) provides always-on detection and automatic inline mitigations to protect against common DDoS attacks at Layer 3 and Layer 4. For a global web application, this foundational protection is essential to maintain availability and low latency under attack.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
AWS Shield
Why this is correct
DDoS protection.
Related concept
Read the scenario before looking for a memorised answer.
AWS Global Accelerator
Amazon Route 53
Why it's wrong here
DNS service, not for content delivery or DDoS.
AWS WAF
Why this is correct
Web application firewall to filter traffic.
Related concept
Read the scenario before looking for a memorised answer.
Amazon CloudFront
Why this is correct
CDN for low-latency content delivery.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
The trap here is that candidates often select AWS Global Accelerator or Route 53 thinking they provide caching or DDoS protection, but Global Accelerator only optimizes network path and Route 53 only handles DNS resolution—neither caches static content nor mitigates application-layer DDoS attacks like CloudFront and WAF do.
Detailed technical explanation
Amazon CloudFront integrates with AWS Shield Advanced and AWS WAF to provide a comprehensive edge security solution. CloudFront’s global edge locations cache static content close to users, reducing latency, while Shield Advanced offers enhanced DDoS protection with 24/7 support and cost protection. AWS WAF allows custom rules to filter malicious requests at the edge, such as SQL injection or cross-site scripting, before they reach the origin.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
An e-commerce site experiences heavy traffic on Black Friday and near-zero traffic during off-peak weeks. Rather than provisioning permanent large VMs, the team uses auto-scaling groups that add capacity automatically under load and reduce it overnight. Questions like this test whether you understand elasticity, availability zones, and cloud compute scaling patterns.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Design for New Solutions — study guide chapter
Learn the concepts, then practise the questions
Design for New Solutions practice questions
Targeted practice on this topic area only
All SAP-C02 questions
1,746 questions across all exam domains
AWS Certified Solutions Architect Professional SAP-C02 study guide
Full concept coverage aligned to exam objectives
SAP-C02 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise SAP-C02 questions linked to Design Solutions for Organizational Complexity.
Practise SAP-C02 questions linked to Design for New Solutions.
Practise SAP-C02 questions linked to Continuous Improvement for Existing Solutions.
Practise SAP-C02 questions linked to Accelerate Workload Migration and Modernization.
Practise SAP-C02 questions linked to SAA-C03 VPC.
Practise SAP-C02 questions linked to SAA-C03 S3 lifecycle policy questions.
Practise SAP-C02 questions linked to SAA-C03 RDS Multi-AZ questions.
Practise SAP-C02 questions linked to SAA-C03 IAM policy.
Practise SAP-C02 questions linked to SAA-C03 Route 53 failover questions.
Practise SAP-C02 questions linked to SAA-C03 CloudFront.
Practise SAP-C02 questions linked to SAA-C03 NAT gateway questions.
Practise SAP-C02 questions linked to SAA-C03 VPC endpoint questions.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Design for New Solutions — This question tests Design for New Solutions — Read the scenario before looking for a memorised answer..
The correct answer is: AWS Shield — AWS Shield (Standard, included by default) provides always-on detection and automatic inline mitigations to protect against common DDoS attacks at Layer 3 and Layer 4. For a global web application, this foundational protection is essential to maintain availability and low latency under attack.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
Last reviewed: Jun 24, 2026
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.