A company needs to automatically protect its Amazon EC2 instances from distributed denial of service (DDoS) attacks. Which AWS service or tool will provide this protection?

AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield Standard is automatically enabled for all AWS customers at no additional cost and provides protection against most common, network and transport layer DDoS attacks that target your website or applications. For higher levels of protection against more sophisticated and larger attacks, AWS Shield Advanced is available. It is the specific service designed for automatic DDoS mitigation.

A. A network access control list (ACL) is a stateless firewall for a subnet that is used for manually allowing or denying traffic. It is not an automatic DDoS mitigation tool.
C. A security group is a stateful firewall for an EC2 instance. It is not designed to mitigate large-scale, volumetric DDoS attacks.
D. Amazon GuardDuty is a threat detection service that monitors for malicious activity but does not actively block or mitigate DDoS attacks.

1. AWS Documentation. (2023). What is AWS Shield?. AWS Shield Developer Guide. Retrieved from https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html. The introduction states, "AWS Shield is a managed distributed denial of service (DDoS) protection service that safeguards applications running on AWS... All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge."

2. AWS Documentation. (2023). AWS Best Practices for DDoS Resiliency (AWS Whitepaper). Retrieved from https://docs.aws.amazon.com/whitepapers/latest/aws-best-practices-ddos-resiliency/welcome.html. Section "AWS Shield" describes its function as the primary service for DDoS protection.