A high-profile municipal elections results site expects volumetric DDoS and sophisticated Layer 7 abuse on election night. Which mitigation strategy best fits?
Select an answer to reveal the explanation.
Short Explanation
Election night is a stadium concert for attackers. Shield Advanced handles the flood of bodies at the gate; WAF checks the tickets and stops the crafty Layer 7 tricks.
Full Explanation
A high-profile municipal elections results site on election night faces both volumetric DDoS and sophisticated Layer 7 abuse. Combining AWS Shield Advanced with AWS WAF rules and appropriate edge or CDN placement mitigates large floods and application-layer exploits with operational support suited to that threat profile. Hosting on a single public EC2 instance with only an OS firewall lacks edge absorption and managed DDoS response. Relying solely on security group allow lists assumes floods cannot saturate bandwidth before SG evaluation helps. Publishing results over unencrypted FTP neither reduces modern HTTP attack surface nor meets integrity expectations for election night data. Exam caveat: Shield Advanced and WAF still need tuned rules, health checks, and a communications plan with election officials during an event. Operational check: enable Shield Advanced and WAF on the edge distribution, run controlled Layer 7 tests in a rehearsal window, verify metrics and notifications, and document who declares mitigation modes on election night. In municipal cloud governance, record the owners, success metrics, and rollback or restore contacts beside this technical choice so the next incident, budget review, or audit does not rediscover the decision from scratch under time pressure.