A global ticket retailer faces Layer 3 floods, Layer 7 SQL injection, and scalper bots during on-sales that crashed checkout last season. The board requires edge protection that absorbs floods with 24/7 DDoS response team access and DDoS cost protection, filters exploits, and manages bots close to users. Which edge security strategy should the architect select to counter DDoS, injection, and bots?

The correct edge strategy works because CloudFront caches and filters at edge locations close to users while Route 53 provides global routing, Shield Advanced absorbs Layer 3 and Layer 4 volumetric floods with always-on detection plus response team support and cost protection, and AWS WAF managed bot control and SQLi rules inspect Layer 7 to block scalper automation and injection before checkout. The strategy using only SQLi rules fails by bot management concept because automated scalper traffic remains unchallenged during on-sales so checkout can still be overwhelmed even while floods and injection are covered. The centralized Application Load Balancer strategy fails by edge proximity concept because terminating traffic in one Region pulls global users and attack volume to the origin, losing CloudFront caching, edge filtering, and dispersion near sources. The Shield Standard strategy fails by flood capacity concept because Standard gives basic network protection but lacks Advanced large-flood absorption, detailed visibility, and expert mitigation required for board-mandated resilience. An exam caveat is to map each layer to its control and place, remembering WAF alone never absorbs network floods and Shield alone never parses SQL or behavior. A practical check is to validate in staging with flood replay, SQLi payload tests, and bot challenges while confirming CloudFront logs, WAF sampled requests, and Shield Advanced events show blocks at the edge.