SOA-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  24/7 access to the DDoS Response Team (DRT)

  Why this is correct

  Shield Advanced provides 24/7 access to the AWS DDoS Response Team (DRT), a specialized crew that can assist during an ongoing attack, perform proactive architectural reviews, and create tailored mitigations. This human-level support is a unique, paid benefit that distinguishes Shield Advanced from the free Shield Standard, making it crucial for high-risk, mission-critical applications.

• ✗

  Free for all AWS accounts

  Why it's wrong here

  Unlike the always-free AWS Shield Standard, AWS Shield Advanced incurs a monthly subscription fee (currently $3,000 per month) plus additional charges for data transfer and for AWS WAF usage when you attach it to protected resources. This cost model means it is absolutely not free for all AWS accounts, and organizations must weigh the expense against their specific DDoS risk profile.

• ✗

  Integration with AWS WAF to create custom rules

  Why it's wrong here

  While AWS Shield Advanced does integrate with AWS WAF, that integration is a supporting capability, not a standalone benefit of Shield Advanced itself. Custom rules and web ACLs are authored, managed, and billed through AWS WAF separately; Shield Advanced simply adds DDoS detection and mitigation on top, so claiming this as a Shield benefit would misrepresent how the services interact.

• ✗

  Automatic scaling of resources during an attack

  Why it's wrong here

  Shield Advanced does not automatically scale your resources or infrastructure during an attack; it only detects and mitigates malicious traffic at the AWS edge. To maintain availability, you must design your application for elasticity using Auto Scaling, load balancing, and other capacity-management tools, since DDoS protection alone cannot provision additional compute or bandwidth.

• ✓

  Enhanced DDoS protection for resources like EC2, ELB, CloudFront, and Route 53

  Why this is correct

  Shield Advanced delivers enhanced, always-on DDoS protection for specific AWS services such as EC2, Elastic Load Balancing, CloudFront, and Route 53, going beyond the basic Layer 3/4 protections of Shield Standard. It includes near real-time attack visibility, health-based detection, and DDoS cost protection that credits eligible resource scaling, making it a strong benefit for internet-facing workloads.

Go deeper

Related to this question