Exam AWS Certified Solutions Architect - Associate SAA-C03 All Questions

View all questions & answers for the AWS Certified Solutions Architect - Associate SAA-C03 exam

Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 35 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Associate SAA-C03

Question #: 35
Topic #: 1

[All AWS Certified Solutions Architect - Associate SAA-C03 Questions]

A company is preparing to launch a public-facing web application in the AWS Cloud. The architecture consists of Amazon EC2 instances within a VPC behind an Elastic Load Balancer (ELB). A third-party service is used for the DNS. The company's solutions architect must recommend a solution to detect and protect against large-scale DDoS attacks.
Which solution meets these requirements?

A. Enable Amazon GuardDuty on the account.
B. Enable Amazon Inspector on the EC2 instances.
C. Enable AWS Shield and assign Amazon Route 53 to it.
D. Enable AWS Shield Advanced and assign the ELB to it.

Show Suggested Answer

Suggested Answer: D 🗳️

by Lilibell at Oct. 12, 2022, 1:06 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

ninjawrz

Highly Voted 2 years, 8 months ago

Selected Answer: D

Answer is D C is incorrect because question says Third party DNS and route 53 is AWS proprietary

upvoted 43 times

kidomaruto

1 year, 7 months ago

Right answer, wrong explanation. You can use Route 53 with a custom domain.. it's all about the "large-scale DDOS attack".

upvoted 22 times

...

BoboChow

Highly Voted 2 years, 8 months ago

Selected Answer: D

AWS Shield Advanced provides expanded DDoS attack protection for your Amazon EC2 instances, Elastic Load Balancing load balancers, CloudFront distributions, Route 53 hosted zones, and AWS Global Accelerator standard accelerators.

upvoted 30 times

leonardh

2 years, 1 month ago

I´d agree as Shield Advanced is the only tier that can protect EC2 which is not possible in Standard.

upvoted 7 times

...

satyaammm

Most Recent 5 months, 4 weeks ago

Selected Answer: D

Only AWS Shield Advanced can help against DDos attacks and since we are using a third-party DNS so we can't attach it to Route 53.

upvoted 3 times

...

MGKYAING

6 months ago

Selected Answer: D

Enabling AWS Shield Advanced provides advanced protection against large-scale DDoS attacks. Assigning the ELB to AWS Shield Advanced ensures that traffic to the web application is monitored and protected with enhanced mitigation techniques. The solution also offers a direct response mechanism (via the AWS DDoS Response Team) for further assistance during attacks.

upvoted 1 times

...

Tjazz04

6 months, 2 weeks ago

Selected Answer: D

Ans. D - Keyword - Large-scale DDoS attacks which the AWS Shield Advanced can prevent

upvoted 1 times

...

zied007

9 months, 3 weeks ago

Selected Answer: D

Answer is D

upvoted 1 times

...

PaulGa

10 months ago

Selected Answer: D

Ans D. Shield (Advanced) is built for DDoS and can interface to ELB

upvoted 2 times

...

awsgeek75

1 year, 5 months ago

Selected Answer: D

A: GuardDuty is not for this, mostly for account monitoring for suspicious activity B: Inspector is for OS vulnerabilities C: Shield with R53 is not going to protect against DDoS D: Shield Advanced is build for DDoS protection

upvoted 7 times

awsgeek75

1 year, 5 months ago

Forgot to mention, C won't work because a 3rd party DNS is used and R53 is not part of the setup

upvoted 4 times

...

awsgeek75

1 year, 5 months ago

Prevent large scale DDOS attack = AWS Shield Advanced

upvoted 2 times

...

A_jaa

1 year, 5 months ago

Selected Answer: D

Answer-D

upvoted 1 times

...

djgodzilla

1 year, 6 months ago

Selected Answer: D

- In addition to the network and transport layer protections that come with Standard, Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. https://aws.amazon.com/shield/features/#:~:text=In%20addition%20to%20the%20network,WAF%2C%20a%20web%20application%20firewall.

upvoted 2 times

...

OmegaLambda7XL9

1 year, 7 months ago

This one got me to be honest

upvoted 3 times

...

Ruffyit

1 year, 8 months ago

Option A is incorrect because Amazon GuardDuty is a threat detection service that focuses on identifying malicious activity and unauthorized behavior within AWS accounts. While it is useful for detecting various security threats, it does not specifically address large-scale DDoS attacks. Option B is also incorrect because Amazon Inspector is a vulnerability assessment service that helps identify security issues and vulnerabilities within EC2. It does not directly protect against DDoS attacks. Option C is not the optimal choice because AWS Shield provides basic DDoS protection for resources such as Elastic IP addresses, CloudFront, and Route53 hosted zones. However, it

upvoted 4 times

Ruffyit

1 year, 8 months ago

does not provide the advanced capabilities and assistance offered by AWS Shield Advanced, which is better suited for protecting against large-scale DDoS attacks. Therefore, option D with AWS Shield Advanced and assigning the ELB to it is the recommended solution to detect and protect against large-scale DDoS attacks in the architecture described.

upvoted 3 times

...