A web application is absorbing a large DDoS attack. The team wants managed volumetric mitigation plus application-layer rate limiting and bot controls they can tune themselves. Which combination provides both?
Show answer and explanation
Answer: D
Shield Advanced adds enhanced DDoS detection, near-real-time attack visibility, cost protection and access to the Shield Response Team for large volumetric events. WAF supplies request-level controls such as rate-based rules, bot control and custom match conditions, and Shield Advanced can engage WAF automatically during an attack.
The two are complementary: one handles the flood, the other shapes what reaches the application.
Why the other options are wrong
- A. Shield Standard is automatic and free but offers no tuning, no response team and no application-layer rate rules.
- B. Shield Advanced improves DDoS mitigation and response, yet it does not provide the custom HTTP match and rate-key logic the team wants.
- C. WAF can throttle and filter requests, but it provides no volumetric mitigation or DDoS response team when the flood saturates the edge.
Exam tip. Volumetric mitigation is Shield Advanced; request-level control is WAF.