Instiq
Chapter 6 · Network Security, Compliance, and Governance·v2.0.0·Updated 7/16/2026·~11 min

What's changed: Deepened ANS-C01 Chapter 6 (SG/NACL eval order/SG references/ephemeral, inspection VPC routing/appliance mode/firewall remits, Shield Adv/WAF Web ACL/Firewall Mgr prereqs/ACM Region + tables, scenarios, FAQ, traps; ja figures)

6.3DDoS Protection and Governance

Key points

Attacks and governance—understand Shield Standard/Advanced, WAF, Firewall Manager, certificate management (ACM), and org-wide policy. Apply protection and control across the board.

Handle external attacks with Shield (DDoS) and WAF (L7), and use Firewall Manager to apply policies centrally across many accounts and resources.

6.3.1Protection and central governance

Diagram of DDoS and application protection: Shield Standard is automatic and free, mitigating common L3/L4 DDoS at the edge; Shield Advanced is paid, for larger attacks with SRT support and cost protection. AWS WAF at L7 filters HTTP requests with SQLi/XSS rules, rate-based rules, and IP/geo match on CloudFront/ALB/API Gateway. AWS Network Firewall is a VPC-level stateful L3-L7 firewall with domain allow-lists, IPS, and egress filtering—choosing DDoS → Shield, web exploits → WAF, VPC firewalling → Network Firewall.
DDoS and application protection
  • Shield Standard: automatic and free, mitigating common L3/L4 DDoS at the edge.
  • Shield Advanced: paid. Advanced protection for large attacks, SRT support and cost protection.
  • WAF: filters HTTP at L7. SQLi/XSS, rate-based rules, IP/geo match.
  • Firewall Manager: centrally apply WAF/Shield/SG/Network Firewall policies org-wide for governance.
Exam point

Common on ANS-C01: L3/L4 DDoS = Shield (large attacks/cost protection = Advanced), L7 SQLi/XSS and rate limiting = WAF, enforce rules org-wide = Firewall Manager, and manage/auto-renew TLS certs = ACM. To enforce the same WAF rules across accounts, use Firewall Manager.

Continue reading — free sign-up

You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.

Get started freeLog in