A public IP on an Application Load Balancer is under a volumetric flood of packets. The proposed fix is a long list of NACL deny rules for the source addresses. Which service is built for that volumetric flood?
Select an answer to reveal the explanation.
Short Explanation
A volumetric flood is a tide, and a NACL is a list of addresses you manage after packets have reached your subnet; AWS Shield is built to protect that public endpoint from DDoS attacks. Systems Manager Inventory and S3 versioning do not rate or filter packets, so you do not inventory your way out of a flood.
Full Explanation
AWS Shield Standard is enabled by default for AWS resources and is designed for common network- and transport-layer volumetric attacks, including attacks on services such as Elastic Load Balancing and CloudFront. Shield Advanced adds detection, cost protection, and response support when a flood requires more help. A longer NACL deny list cannot absorb traffic that has already saturated a path; packets still arrive, and source-address lists can go stale as you chase them. Systems Manager Inventory collects resource information, but it does not rate or filter packet floods. S3 versioning preserves object versions in the access-log bucket; it does not filter traffic. Exam caveat: Shield does not replace WAF for an HTTP scrape or abuse at the HTTP layer, and it cannot fix an application bug that causes slow responses. Match volumetric packets to Shield and HTTP abuse to WAF. Practical check: confirm the load balancer is the resource under attack, and if the event exceeds what Shield Standard addresses, engage Shield Advanced for that specific resource rather than expanding the NACL.