A public library website faces elevated DDoS risk during contentious community meetings. Which architecture best improves edge DDoS resilience?
Select an answer to reveal the explanation.
Short Explanation
When a crowd surges the library doors, you want a wide plaza and trained security—not one folding chair at the entrance. CloudFront plus WAF at the edge, with Shield protections, absorbs and filters volumetric and many application-layer floods. One lonely EC2 EIP or exposing the database is inviting the surge inside.
Full Explanation
A public library website facing elevated DDoS risk during contentious community meetings is best protected by fronting the origin with Amazon CloudFront and AWS WAF, while relying on AWS Shield (Standard included with CloudFront/ALB-style edges, and Shield Advanced when deeper protections and response support are justified). Edge distribution absorbs and disperses volumetric abuse closer to viewers, WAF filters application-layer exploits, and Shield provides DDoS detection/mitigation at the AWS edge—matching civic need to keep community information available under load.
Terminating all visitor traffic on a single EC2 instance in one Availability Zone with an Elastic IP fails because a solitary public origin is a trivial volumetric and availability single point of failure. Disabling HTTPS so attack traffic is easier to inspect in cleartext fails conceptually: it sacrifices confidentiality and integrity for citizens and does not constitute a DDoS architecture. Publishing the origin database endpoint on the internet so visitors can bypass the website fails because it expands critical-data exposure and invites direct attacks on the data tier during the very incidents you are trying to weather.
Exam caveat: CloudFront and WAF help only if the origin is not also publicly reachable on alternate hostnames or ports that attackers can discover and flood directly. Operational check: lock the origin to CloudFront (OAC/OAI or security-group/source restrictions), attach a WAF web ACL with baseline managed rules, validate caching and health under load tests, and define when Shield Advanced engagement is warranted for high-profile meeting nights.