{"question":{"id":37248,"htmlId":"question37248","kind":"SingleChoice","specVersion":null,"questionHtml":"

A global media company runs a high-traffic application on AWS, using a CloudFront distribution, an Application Load Balancer, and Amazon Route 53. The company has subscribed to AWS Shield Advanced to protect against large-scale DDoS attacks. During a recent security drill, the operations team struggled to manually create effective AWS WAF rules in time to mitigate a simulated, sophisticated Layer 7 attack. The company wants a solution that provides access to specialized expertise to help create and deploy custom mitigations during such an event. What should a solutions architect recommend to meet this requirement?

","descriptionHtml":"

The correct answer is to contact the AWS Shield Response Team (SRT). A key benefit of the AWS Shield Advanced subscription is 24/7 access to the SRT, which is a team of AWS experts who specialize in DDoS attack mitigation. During an attack, customers can engage the SRT to help analyze traffic, identify novel attack patterns, and author custom AWS WAF rules to mitigate the threat.

Enabling proactive engagement is incorrect because this feature allows the SRT to contact you if they detect a DDoS event that is impacting the health of your application (as monitored by a Route 53 health check). It is not the mechanism for you to request assistance with writing custom WAF rules. Subscribing to a third-party managed rule set is a good security practice but does not fulfill the requirement for real-time, specialized expertise to handle a novel attack pattern that the rule set may not cover. Automating WAF rule creation with GuardDuty and Lambda is a possible custom solution, but it is not the most direct or effective method provided by the Shield Advanced service for getting expert assistance during a complex attack; the SRT is the purpose-built solution for this scenario.

","answers":[{"id":2551200,"html":"

Create an AWS Lambda function triggered by Amazon GuardDuty findings to automatically update the WAF ACLs.

","isCorrect":false},{"id":2551199,"html":"

Subscribe to a third-party managed rule set from the AWS Marketplace for AWS WAF to block sophisticated attacks.

","isCorrect":false},{"id":2551197,"html":"

Contact the AWS Shield Response Team (SRT) to get assistance in analyzing the attack pattern and creating custom AWS WAF rules.

","isCorrect":true},{"id":2551198,"html":"

Enable proactive engagement in the Shield Advanced settings to have the SRT automatically apply custom WAF rules.

","isCorrect":false}],"textInput":null,"matching":null,"objectiveId":1898,"objectiveTitle":"Design for New Solutions","nextQuestionUrl":"/study/questions/sap-c02/a-global-financial-services-company-is-using-aws-organizations-to-manage-a/37259?HideScore=false&ObjectiveMode=RoundRobbinObjectives","questionUrl":"/study/questions/sap-c02/a-global-media-company-runs-a-high-traffic-application-on-aws-using-a/37248","followUpPrompts":[{"id":305580,"prompt":"What is the AWS Shield Response Team (SRT) and how do I engage them during an attack?","response":"The AWS Shield Response Team (SRT) is a group of AWS experts available to Shield Advanced subscribers for mitigation of large or sophisticated DDoS events. They analyze traffic patterns, identify novel attack vectors (especially Layer 7/web attacks), and help author and deploy custom AWS WAF rules or other mitigations to protect your application. To engage the SRT, Shield Advanced customers open a Shield incident with AWS Support (via the AWS Support Center or the Shield console). The SRT is available 24/7 for active incidents and can collaborate with your on-call ops/security team to implement targeted protections and monitor effectiveness. Note: SRT engagement is the purpose-built, expert-driven path for real-time, complex mitigation — more reliable for novel attacks than relying solely on managed rules or untested automation."},{"id":305581,"prompt":"What is proactive engagement in Shield Advanced and how does it differ from requesting SRT help?","response":"Proactive engagement is a Shield Advanced feature where the SRT can proactively contact you if AWS detects a DDoS event affecting your application health (often monitored via Route 53 health checks). It aims to ensure the SRT reaches out when they detect impact. However, it is not a substitute for actively requesting assistance: proactive engagement does not itself apply custom WAF rules on your behalf. By contrast, when you open an incident (request SRT help), the SRT will actively analyze traffic, recommend and help author custom AWS WAF rules, and jointly deploy mitigations. In short: proactive engagement is a monitoring/notification option; direct SRT engagement is the on-demand expert assistance used to design and implement custom mitigations during an attack."},{"id":305582,"prompt":"When should I use third-party managed WAF rules or automated GuardDuty+Lambda actions instead of contacting SRT?","response":"Managed WAF rule sets (from AWS Marketplace) and automation (e.g., Amazon GuardDuty findings triggering Lambda updates to WAF ACLs) are useful for addressing known, common attack patterns quickly and at scale. They’re good for baseline protection and can reduce repetitive manual work. However, they have limitations: managed rules may not cover novel, sophisticated Layer 7 attacks; automated responses risk false positives and require rigorous testing and tuning; and automation may not adapt quickly to unexpected attack tactics. For complex, novel, or high-impact events where you need specialized analysis and bespoke rule creation, contacting the SRT (Shield Advanced) is the recommended approach. Use managed rules/automation for routine protection and SRT engagement for expert, real-time mitigation of unusual or escalating attacks."}],"presentationMode":false,"hideFeedbackForm":false,"hideResponseBadges":false,"setId":null,"skipSaveResponse":false},"canVote":false,"streak":{"value":null,"title":null,"launchConfetti":false,"isRecord":false},"id":"crucial-react-363aea40ddcd442ba99a522dd7c347eb"}

AWS Certified Solutions Architect Professional SAP-C02 Practice Question

Report Issue