AWS Interview DropIntermediate TierScenario+25 XP on read
Design layered protection for a public-facing web application against DDoS attacks and common web exploits.
Core Summary
No single AWS service handles both problems, since a volumetric DDoS attack and a targeted web exploit look nothing alike at the network layer. CloudFront and Shield absorb and dilute volume before it reaches your origin, and WAF inspects individual requests for exploit patterns. Both sit in front of the origin, stacked, not swapped for each other.
Hints
Hint 1: Shield Standard is already on by default; the real decision is whether you need Shield Advanced
Hint 2: WAF inspects request content, Shield and CloudFront handle volume, they're not substitutes
Hint 3: Rate-based WAF rules catch application-layer floods that Shield alone won't