Security, Identity, and Compliance
CoreAWS Shield
Managed DDoS protection for supported AWS resources, with baseline and advanced service levels.
Key points
- Shield addresses volumetric and protocol DDoS protection at supported network/edge resources.
- Advanced protection adds capabilities and response support for eligible resources but does not replace resilient scaling and origin design.
- Combine Shield with WAF for application-layer request controls.
Best-known use cases
- Protect internet-facing CloudFront, Route 53, and load-balanced applications from DDoS.
- Add enhanced DDoS visibility and response for critical eligible applications.
What candidates often confuse it with
- Shield addresses DDoS; WAF filters Layer 7 web requests.
- Shield protects supported edges; Network Firewall inspects VPC network traffic.
Key takeaway
Choose Shield for DDoS protection and WAF for application-request filtering; they are complementary.
Related services
- AWS WAF
- Amazon CloudFront
- Amazon Route 53
- Elastic Load Balancing (ELB)
Relevant exam tasks
- D1.2