A public library website faces elevated DDoS risk during contentious community meetings. Which architecture best improves edge DDoS resilience?
Select an answer to reveal the explanation.
Short Explanation
When a crowd surges the library doors, you want a wide plaza and trained security—not one folding chair at the entrance. CloudFront plus WAF at the edge, with Shield protections, absorbs and filters volumetric and many application-layer floods. One lonely EC2 EIP or exposing the database is inviting the surge inside.
Full Explanation
AWS Shield Standard is included for common network and transport layer DDoS protections on AWS resources; Shield Advanced adds enhanced detection, mitigation, and response options for critical workloads. Pairing CloudFront and AWS WAF moves filtering closer to users and reduces load on origins during attacks. A single-AZ public instance, disabling TLS, or exposing databases to the internet worsens availability and security rather than improving DDoS resilience.