A global ticket marketplace faces credential stuffing bursts, Layer 7 DDoS during on-sales, and scraper bots copying prices, needs low latency in 20 countries, and must keep origin costs stable. Which edge security strategy should the architect select to counter volumetric and bot-driven application threats?

The correct strategy succeeds because it layers edge performance with specialized defenses: CloudFront caching across 20 countries lowers latency and shields the origin from repeated price requests to stabilize costs, WAF Bot Control gives managed detection for credential stuffing and scrapers, rate-based rules throttle high-velocity bursts, and Shield Advanced adds Layer 7 DDoS detection for on-sales. The CloudFront design using only rate-based rules and Shield Advanced fails by concept because throttling cannot verify intent, so low-and-slow logins and rotating-IP scrapers evade limits and keep copying prices. The CloudFront design using Bot Control and Shield Advanced fails by concept because classification without velocity control cannot stop burst floods overwhelming login logic. The regional ALB design with full WAF and Shield protection fails by concept because without global edge caching all flash-sale traffic hits the origin, raising latency and cost. For the exam, match each threat to a distinct control rather than assuming WAF covers everything. In practice, check WAF logs and Bot labels, tune rate limits from load tests, and track cache hit ratio with Shield events.