SCS-C02 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Amazon CloudFront

  Why it's wrong here

  Amazon CloudFront distributes content over a global network of edge POPs, and its anycast routing and edge caching can absorb some volumetric attacks so they never reach the origin EC2 instances. However, CloudFront only protects traffic that is served through a distribution, and it does not provide the dedicated always-on monitoring, mitigation tuning, or cost protections of AWS Shield Advanced. Since the company's EC2 instances are the target and may not even be fronted by CloudFront, CloudFront alone isn't the right protection service.

• ✗

  Amazon GuardDuty

  Why it's wrong here

  Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, Route 53 DNS logs, and CloudTrail event history to identify anomalous behavior such as reconnaissance or port scanning. It does not sit in the network path and cannot drop or scrub malicious traffic, so it has no direct ability to mitigate a DDoS attack. GuardDuty findings can trigger automated corrective actions, but the service itself is detective and doesn't prevent or stop an ongoing DDoS flood.

• ✓

  AWS Shield Advanced

  Why this is correct

  AWS Shield Advanced is purpose-built for DDoS protection, providing enhanced always-on detection and automatic inline mitigation for network-layer (L3/L4) attacks such as SYN floods and UDP reflection. It works by absorbing attack traffic and rerouting it to AWS's global scrubbing infrastructure while maintaining availability of protected resources like EC2 instances. Advanced also adds cost protection (DDoS-induced spikes are charged back as credits), access to the AWS DDoS Response Team (DRT), and integration with AWS WAF for additional Layer 7 defense. This is the service designed to directly protect EC2 from DDoS attacks.

• ✗

  AWS WAF

  Why it's wrong here

  AWS WAF operates at the application layer (Layer 7) and filters incoming HTTP(S) requests using customizable rules, such as IP match conditions, rate-based blocking, SQL injection, and cross-site scripting protections. While a rate-based rule can mitigate certain HTTP flood attacks, WAF cannot defend against network-layer DDoS events like TCP SYN floods or UDP amplification attacks because those never reach the WAF engine as HTTP requests. The company's requirement is generic DDoS protection, not just web request filtering, so WAF alone is insufficient.

Go deeper

Related to this question