A global gaming studio launching a tournament site expects volumetric DDoS, bot account creation, and application exploits. Leadership wants a threat-informed edge plan that separates network-layer from application-layer controls before buying services. Which edge security strategy aligns controls to anticipated threats?
Select an answer to reveal the explanation.
Short Explanation
You match each attacker to the right shield. Network floods need absorb-and-disperse while bots need request inspection, so layered-edge wins. You're sorting brawlers at the door versus pickpockets inside.
Full Explanation
A threat-informed edge strategy distinguishes L3/L4 volumetric attacks best absorbed by AWS Shield with CloudFront global distribution and Anycast from L7 threats like credential stuffing, bots, and OWASP injection best inspected by AWS WAF with bot control and managed rule groups deployed at CloudFront or Application Load Balancer. A VPC network firewall behind NAT gateways inspects outbound and inter-VPC traffic but cannot absorb internet-scale floods before they reach the region and adds no bot logic. Client VPN with Direct Connect provides private workforce connectivity and hybrid bandwidth, which is irrelevant to protecting public tournament endpoints from anonymous floods. Security groups and network ACLs enforce instance and subnet filtering but do not exist on CloudFront edge locations and lack WAF request inspection. On the exam, associate Shield with DDoS, CloudFront with distribution, and WAF with L7 rules. In practice, validate with threat modeling and confirm Shield Advanced DRT access and WAF logging to S3.