You are working in an e-commerce company. It is essential to monitor the stability of its applications continuously and notify the site reliability engineering team when there is an ongoing DDoS attack. AWS Shield Advanced has been enabled in the AWS account. How would you configure the notifications for an ongoing DDoS event?

Answer options:

A.Configure a CloudWatch event rule for the DDoSDetected event of Shield Advanced. Register an AWS SNS topic in the target of the rule.
B.Configure a CloudWatch log filter for the Shield Advanced logs. If the logs contain “DDoSDetected”, trigger a CloudWatch alarm to provide notifications.
C.Configure a CloudWatch alarm for the DDoSDetected metric of Shield Advanced. Trigger an AWS SNS notification.
D.Configure a CloudWatch alarm in the global threat dashboard of the AWS Shield Advanced console.

Correct Answer: C
Option A is incorrect because Shield Advanced does not provide the “DDoSDetected” event in CloudWatch Event.
Option B is incorrect because Shield Advanced does not forward its logs to CloudWatch Logs.
Option C is CORRECT because the DDoSDetected CloudWatch metric indicates whether a DDoS event is underway. Users can set up a CloudWatch alarm to notify the team based on the metric.
Option D is incorrect because users cannot configure alarms or notifications on the dashboard. The global threat dashboard is a place to provide a summary of the global AWS threat landscape.
Reference:
https://docs.aws.amazon.com/waf/latest/developerguide/monitoring-cloudwatch.html