A public citizen portal needs filtering for common web exploits in HTTP requests, while a separate concern is absorbing large volumetric DDoS floods. Which service pairing matches those attack types?
Select an answer to reveal the explanation.
Short Explanation
Web exploit noise in the HTTP request? That is WAF territory. A traffic tidal wave trying to knock the site over? That is Shield’s DDoS lane. Match the attack to the tool.
Full Explanation
A public citizen portal that needs filtering for common web exploits in HTTP requests, while separately absorbing large volumetric DDoS floods, maps to AWS WAF for HTTP exploit filtering and AWS Shield for volumetric DDoS protection. WAF inspects request contents and metadata against web ACL rules to block injection, XSS, bad bots, and similar Layer-7 abuse. Shield Standard provides always-on DDoS protections for AWS resources, and Shield Advanced adds enhanced detection, mitigation, and operational support for larger events. Municipal portals exposed on the internet commonly need both controls working together.
Reversing the pairing—Shield for SQL injection signatures and WAF for volumetric floods—mixes the layers incorrectly. Amazon Inspector assesses workload vulnerabilities and network reachability findings; it is not a live DDoS scrubbing fabric at every edge location. AWS Backup protects data with backup plans and restores; restoring after every HTTP probe is neither practical nor a substitute for preventive WAF and Shield controls at the edge or load balancer.
Exam caveat: Anytime a stem separates “web exploits / HTTP” from “volumetric DDoS,” answer WAF + Shield in that respective order. Do not assign Inspector or Backup to live attack mitigation roles.
Operational check: place CloudFront or an ALB in front of the citizen portal, attach a WAF web ACL with managed rule groups, ensure Shield protections apply to the exposed resources, validate with synthetic blocked requests and a tabletop DDoS runbook, and monitor WAF blocked-request metrics alongside Shield event notifications so the city’s SOC can tell application-layer probes apart from volumetric floods.