A city clerk launches a public citizen portal that must stay available during traffic floods and volumetric attacks. At foundational identify depth, which AWS service is purpose-built for DDoS protection of such internet-facing workloads?
Select an answer to reveal the explanation.
Short Explanation
Think of Shield like a storm berm in front of a public beach parking lot — it is there when a flood of unwanted traffic tries to knock the citizen portal offline. Config and Artifact help with compliance paperwork and settings, not packet floods. Audit Manager gathers evidence; it does not soak up DDoS traffic.
Full Explanation
AWS Shield provides managed DDoS protection for AWS applications, acting like a storm berm in front of a public beach parking lot when a flood of unwanted traffic tries to knock a citizen portal offline. That is the service to name when the threat model is volumetric or protocol denial-of-service against AWS-hosted applications. AWS Config evaluates resource configurations against rules; it does not absorb denial-of-service packets. AWS Audit Manager helps collect audit evidence; collecting exhibits does not stop network floods. AWS Artifact publishes compliance PDFs; those documents do not mitigate active DDoS events. Distractors fail by swapping compliance and configuration tooling for traffic-flood protection. Exam caveat: Shield Standard is available for many AWS customers as a baseline, while Shield Advanced adds richer protections and support engagement — exam stems may simply say "Shield" for the DDoS category. Operational check: confirm public-facing civic endpoints sit behind architectures that benefit from Shield, combine with AWS WAF where Layer 7 exploits matter, rehearse incident contacts, and ensure monitoring distinguishes availability drops caused by attacks versus application faults.