Your company plans to set up an application that consists of EC2 Instances, an Application Load Balancer and Cloudfront. Your management is worried about DDOs attacks. Which of the following can help protect against such network attacks? Choose 3 answers from the options given below.

Answer options:

A.Place the AWS WAF in front of the Application Load Balancer.
B.Place the AWS WAF in front of the Cloudfront Distribution.
C.Place the AWS WAF in front of the EC2 Instances.
D.Consider using AWS Shield Advanced.

Answer – A, B and D
The AWS Documentation mentions the following.
AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests forwarded to Amazon CloudFront or an Application Load Balancer. AWS WAF also lets you control access to your content. Based on conditions that you specify, such as the IP addresses that requests originate from or the values of query strings, CloudFront or an Application Load Balancer responds to requests either with the requested content or an HTTP 403 status code (Forbidden).
AWS Shield Advanced provides expanded DDoS attack protection for your Amazon EC2 instances, Elastic Load Balancing load balancers, CloudFront distributions, and Route 53 hosted zones. AWS Shield Advanced incurs additional charges.
Option C is incorrect since AWS WAF can only be used with the Application Load Balancer and the Cloudfront Distribution.
For more information on AWS WAF, please refer to the below URL
https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html