Correct Answer: A
The AWS Documentation mentions the following.
For higher levels of protection against attacks targeting your applications running on Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing(ELB), Amazon CloudFront, and Amazon Route 53 resources, you can subscribe to AWS Shield Advanced. In addition to the network and transport layer protections that come with Standard, AWS Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, and integration with AWS WAF, a web application firewall. AWS Shield Advanced also gives you 24x7 access to the AWS DDoS Response Team (DRT) and protection against DDoS related spikes in your Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing(ELB), Amazon CloudFront, and Amazon Route 53 charges.
Option B is incorrect since this can be used to scan instances for vulnerabilities.
Option C is partially correct. You can use the WAF service against certain types of attacks. But for major DDoS attacks, you need to use the AWS Shield Advanced Service.
Option D is incorrect since this service cannot protect against DDoS attacks.
For more information on AWS Shield service, please refer to the below URL-
https://aws.amazon.com/shield/