The AWS Security Specialty exam rarely asks “what is AWS WAF?” Instead it hands you a scenario — “a public API is being flooded with requests from thousands of IPs,” “the security team needs the same WAF rules enforced across 200 accounts automatically,” “traffic must be inspected at the VPC level with deep-packet and domain filtering” — and asks which service solves it. The edge- and network-protection services all sound similar, they overlap in confusing ways, and the SCS-C02 loves to test whether you can tell them apart under pressure.
This guide draws sharp lines between the five services the exam tests for perimeter defense: AWS WAF, AWS Shield, Shield Advanced, AWS Firewall Manager, and AWS Network Firewall. For each you will learn what it actually does, the layer it operates at, the exact keyword that signals it, and how it fits the others. If you are mapping your full preparation, anchor this to the AWS Security Specialty exam guide for 2026; edge protection sits inside the Infrastructure Security domain and complements the broader infrastructure security material.
The One-Sentence Test That Separates the Five Services
Before the detail, memorize these one-liners. On most exam questions this alone gets you to the answer.
| Service | The one-sentence job | Layer | Signal words |
|---|---|---|---|
| AWS WAF | Filters HTTP(S) requests by rules — SQLi, XSS, rate limits, geo, IP | Layer 7 (application) | “SQL injection,” “malicious requests,” “rate limit,” “block by country” |
| AWS Shield (Standard) | Automatic, always-on protection against common network/transport DDoS | Layer 3/4 | ”automatic DDoS,” “no cost,” “SYN flood,” “already included” |
| Shield Advanced | Enhanced DDoS protection, cost protection, 24/7 response team | Layer 3/4/7 | ”DDoS Response Team,” “cost protection,” “large-scale attack,” “SLA” |
| Firewall Manager | Centrally manages WAF/Shield/rules across many accounts | Management | ”across all accounts,” “centrally enforce,” “future accounts,” “Organizations” |
| Network Firewall | Stateful VPC traffic inspection — deep-packet, domain, IPS/IDS | Layer 3–7 in the VPC | ”VPC traffic,” “domain filtering,” “intrusion prevention,” “egress filtering” |
The classic exam confusion is WAF versus Network Firewall, and Shield versus Shield Advanced. Say the distinctions out loud until they are automatic: WAF inspects HTTP requests at the edge; Network Firewall inspects packets inside your VPC. Shield Standard is free and automatic; Shield Advanced is paid and adds a response team, cost protection, and richer detection.
AWS WAF: Layer 7 Request Filtering
AWS WAF (Web Application Firewall) inspects HTTP and HTTPS requests and allows, blocks, counts, or challenges them based on rules. It protects the OWASP-style application layer, which network firewalls and Shield cannot see. The exam expects you to know where it attaches and what it can match.
Where WAF Attaches
A WAF web ACL associates with one of these resources — memorize the list, because a question sometimes hinges on it:
- Amazon CloudFront distributions (global edge)
- Application Load Balancers (regional)
- API Gateway REST APIs
- AWS AppSync GraphQL APIs
- Cognito user pools, App Runner, and Verified Access
Note the absence: WAF does not attach to a Network Load Balancer (Layer 4) or directly to an EC2 instance. If a scenario needs Layer 7 filtering in front of an NLB or TCP service, that is a hint toward a different design (front it with CloudFront/ALB, or use Network Firewall).
What WAF Rules Can Do
- Managed rule groups — AWS-managed and Marketplace rule sets that block known-bad patterns (SQL injection, cross-site scripting, known bad inputs, the OWASP Top 10). The exam favours managed rules for “protect against common web exploits with minimal effort.”
- Rate-based rules — block or throttle a source IP that exceeds a request threshold in a 5-minute window. This is the answer to application-layer (Layer 7) flood and HTTP request abuse.
- IP sets and geo match — allow/deny by IP range or by country.
- String, regex, and size match — inspect URI, headers, query strings, and body.
- Bot Control and account-takeover / fraud prevention managed groups for automated-traffic and credential-stuffing scenarios.
Exam signal: “block requests containing SQL injection or cross-site scripting” → AWS WAF managed rule groups. “One IP or client is sending an abnormal volume of HTTP requests” → WAF rate-based rule.
WAF logs can be sent to CloudWatch Logs, S3, or Kinesis Data Firehose, which ties into logging and monitoring questions about analyzing blocked traffic.
AWS Shield Standard: Always-On, Free DDoS Protection
AWS Shield Standard is automatically enabled for all AWS customers at no additional cost. It defends against the most common network- and transport-layer (Layer 3/4) DDoS attacks — SYN floods, UDP reflection, and similar volumetric attacks — for services like CloudFront, Route 53, and Global Accelerator, which have Shield protection built into the edge.
The exam facts that matter:
- It is free and automatic — you do not enable or configure it. If a question asks “what protects against common DDoS with no setup or cost,” the answer is Shield Standard.
- It focuses on Layer 3/4. It does not give you Layer 7 application protection (that is WAF) or the advanced features and support of Shield Advanced.
- Protection is strongest at the edge — using CloudFront and Route 53 in front of your application inherently improves DDoS resilience.
Shield Advanced: Enhanced Protection, Cost Protection, and the Response Team
AWS Shield Advanced is a paid subscription (a monthly fee with a typical annual commitment) that layers enterprise-grade DDoS protection on top of Standard. The SCS-C02 tests the specific features that justify the cost.
| Feature | Shield Standard | Shield Advanced |
|---|---|---|
| Cost | Free | Paid subscription |
| Layer 3/4 DDoS mitigation | Yes (common attacks) | Yes (enhanced, larger attacks) |
| Layer 7 DDoS detection | No | Yes, with WAF integration |
| DDoS cost protection (credits for scaling during an attack) | No | Yes |
| DDoS Response Team (DRT / SRT) 24/7 access | No | Yes |
| Real-time attack visibility and reporting | Limited | Yes |
| Protected resource types | Edge services | ELB, CloudFront, Global Accelerator, Route 53, EIP |
| Automatic WAF rule application during attacks | No | Yes (automatic application-layer DDoS mitigation) |
The distinguishing keywords for Shield Advanced:
- “DDoS cost protection” or “absorb the cost of scaling during an attack” — Advanced credits back scaling charges caused by a DDoS event. This is unique to Advanced.
- “24/7 access to a response team” / “engage AWS experts during an attack” — the Shield Response Team (SRT, formerly DRT).
- “SLA-backed”, “large or sophisticated attacks”, “real-time attack metrics and reports.”
Shield Advanced also integrates with WAF and Firewall Manager: you can have it automatically apply WAF rules to mitigate application-layer floods, and manage Advanced protections centrally across accounts. When a scenario combines “large-scale DDoS,” “financial protection,” and “expert support,” the answer is Shield Advanced, usually paired with WAF for the Layer 7 component.
AWS Firewall Manager: Central Governance Across Accounts
Everything above configures protection for a single resource or account. At enterprise scale — dozens or hundreds of accounts under AWS Organizations — you need to enforce it consistently and automatically. That is AWS Firewall Manager.
Firewall Manager lets a central security team define security policies once and apply them across every account and resource in the organization, including accounts and resources created in the future. It can centrally manage:
- AWS WAF rules and web ACLs
- Shield Advanced protections
- AWS Network Firewall policies
- Route 53 Resolver DNS Firewall rules
- Security group policies (audit and enforce)
Prerequisites the exam checks:
- Firewall Manager requires AWS Organizations with all features enabled.
- It requires AWS Config to be enabled in the member accounts (it evaluates resources).
- You designate a delegated administrator account for Firewall Manager so the management account is not used for day-to-day operations.
Exam signal: “enforce the same WAF rules across all current and future accounts automatically” or “ensure no account can remove the required protections” → AWS Firewall Manager. If the requirement is a single account only, you do not need Firewall Manager — plain WAF/Shield suffices. Choosing Firewall Manager for a single-account scenario is a common distractor trap.
AWS Network Firewall: Stateful Inspection Inside the VPC
AWS Network Firewall is a managed, stateful network firewall and intrusion prevention/detection system (IPS/IDS) that inspects traffic inside your VPC, at the subnet/route level. Where WAF sees HTTP requests at the application edge, Network Firewall sees packets and flows crossing your VPC boundaries — north-south and, with the right routing, east-west.
What the exam expects you to associate with Network Firewall:
- Stateful and stateless rule groups, including Suricata-compatible IPS rules for signature-based intrusion prevention.
- Domain-name filtering / allow-lists — restrict outbound traffic to approved domains. This is a favourite answer for egress control (“only allow instances to reach *.amazonaws.com and a specific vendor domain”).
- Deep packet inspection and protocol filtering that WAF and security groups cannot perform.
- Deployment through firewall endpoints in dedicated subnets, with VPC route tables steering traffic through them.
Contrast it clearly with two neighbours:
- Network Firewall vs WAF: Network Firewall inspects VPC network traffic (Layer 3–7 packet/flow, IPS, domain filtering); WAF inspects HTTP requests at CloudFront/ALB/API Gateway. “Filter VPC egress by domain” → Network Firewall. “Block SQL injection on a web app” → WAF.
- Network Firewall vs Route 53 Resolver DNS Firewall: DNS Firewall filters DNS queries (block resolution of malicious domains) and is lightweight; Network Firewall does full traffic inspection. “Block DNS lookups of known-bad domains” → DNS Firewall. “Inspect and filter the actual traffic, IPS, egress by domain over HTTP/TLS” → Network Firewall.
The Layered Perimeter: How They Fit Together
These services are not either/or — a hardened AWS perimeter uses several together, each at its layer. A canonical exam-aligned design for a public web application:
- Route 53 + CloudFront at the edge, giving built-in Shield Standard absorption of common Layer 3/4 DDoS.
- AWS WAF on the CloudFront distribution, with managed rule groups (OWASP/SQLi/XSS), rate-based rules for HTTP floods, and geo/IP controls.
- Shield Advanced if the workload is business-critical and needs cost protection, the response team, and automatic Layer 7 DDoS mitigation.
- Network Firewall in the VPC for egress domain filtering and IPS/IDS on internal traffic.
- Firewall Manager across the organization so all of the above is enforced consistently on every current and future account.
Read each scenario for the layer it targets. “Requests,” “SQLi,” “rate limit” → WAF (Layer 7). “Volumetric DDoS,” “cost protection,” “response team” → Shield/Shield Advanced (Layer 3/4). “VPC traffic,” “egress by domain,” “IPS” → Network Firewall. “Across all accounts,” “future accounts,” “centrally enforce” → Firewall Manager. Match the keyword to the layer and the distractors fall away.
Common SCS-C02 Traps in This Topic
- Choosing Firewall Manager for a single account. Firewall Manager is for organization-wide governance. A single-account requirement is solved by WAF/Shield directly.
- Expecting WAF to stop a Layer 3/4 DDoS. WAF filters HTTP requests; a SYN/UDP flood is mitigated by Shield. WAF handles the Layer 7 flood (rate-based rules).
- Using WAF for VPC egress filtering. WAF cannot filter outbound VPC traffic by domain — that is Network Firewall (or DNS Firewall for DNS-only).
- Assuming Shield Advanced is automatic. Standard is automatic and free; Advanced is a paid subscription you must enable, and it is what unlocks cost protection and the response team.
- Confusing Network Firewall with security groups/NACLs. Security groups and NACLs are stateless/stateful allow-deny at instance/subnet level without deep inspection; Network Firewall adds DPI, IPS, and domain filtering. This overlaps with core infrastructure security knowledge.
Practice Until the Keywords Are Reflexive
Understanding these five services is necessary but not sufficient. SCS-C02 questions are dense and deliberately blur the lines — a rate-based-rule scenario dressed up to look like a DDoS question, a single-account requirement seeded with organization-sounding language to bait you toward Firewall Manager. The reliable way to build the reflex that maps each scenario to the right service under time pressure is repeated exposure to realistic, explained questions.
The AWS Security Specialty (SCS-C02) mock exam bundle is built for exactly that: 8 full-length timed exams of exam-difficulty scenarios spanning all six domains, each with a detailed explanation that draws the distinctions this article covers. Pair it with a structured 30-day study plan and the deeper threat detection and incident response and GuardDuty material to round out the security-services picture before exam day.
Frequently Asked Questions
What is the difference between AWS WAF and AWS Network Firewall?
AWS WAF inspects HTTP/HTTPS requests at the application layer and attaches to CloudFront, ALB, API Gateway, and AppSync — it blocks SQL injection, XSS, and HTTP floods. AWS Network Firewall inspects packets and flows inside your VPC (Layer 3–7), offering deep-packet inspection, IPS/IDS, and domain-based egress filtering. Use WAF for web-request filtering; use Network Firewall for VPC network traffic inspection and egress control.
What is the difference between AWS Shield and Shield Advanced?
Shield Standard is free, automatic, and protects against common Layer 3/4 DDoS attacks with no configuration. Shield Advanced is a paid subscription that adds enhanced mitigation for large attacks, application-layer (Layer 7) DDoS protection via WAF integration, DDoS cost protection (credits for scaling during an attack), 24/7 access to the Shield Response Team, and detailed real-time attack reporting.
When do I need AWS Firewall Manager?
Use Firewall Manager when you must enforce WAF, Shield Advanced, Network Firewall, DNS Firewall, or security-group policies consistently across many accounts in AWS Organizations, including future accounts. For a single account, configure WAF/Shield directly — Firewall Manager is unnecessary overhead and a common wrong-answer trap in single-account scenarios.
Does AWS WAF protect against DDoS attacks?
WAF protects against application-layer (Layer 7) request-based attacks using rate-based rules and managed rules, but it does not mitigate network/transport-layer (Layer 3/4) volumetric DDoS such as SYN or UDP floods — those are handled by AWS Shield (Standard automatically, Advanced for large or sophisticated attacks). A complete DDoS defense typically combines Shield for Layer 3/4 with WAF rate-based rules for Layer 7.
How do I filter outbound VPC traffic to only approved domains?
Use AWS Network Firewall with stateful domain-name allow-lists to restrict egress to approved domains, or Route 53 Resolver DNS Firewall if you only need to block DNS resolution of specific domains. Security groups and NACLs cannot filter by domain name, and AWS WAF only inspects inbound HTTP requests, not VPC egress.
Which services get automatic Shield Standard protection?
Shield Standard protection is strongest for edge and AWS-managed services — Amazon CloudFront, Amazon Route 53, and AWS Global Accelerator — which is why fronting an application with CloudFront and Route 53 improves its baseline DDoS resilience at no extra cost.
Conclusion
Edge and network protection on the SCS-C02 is a service-selection discipline: five overlapping-sounding services, each operating at a specific layer. WAF filters HTTP requests at the application edge; Shield Standard absorbs common Layer 3/4 DDoS for free and automatically; Shield Advanced adds enhanced mitigation, cost protection, and the response team for critical workloads; Network Firewall performs stateful, deep-packet inspection and egress filtering inside the VPC; and Firewall Manager enforces all of it consistently across the whole organization. Learn the one-sentence job and the signal words for each, watch for the single-account-Firewall-Manager and WAF-stops-volumetric-DDoS traps, and confirm your judgment with realistic timed practice. Match the keyword to the layer, and these questions become some of the most reliably winnable points on the exam.