For volumetric DDoS, the primary goal is to absorb and disperse massive traffic floods before they overwhelm bandwidth, edge links, or the application entry point. Placing a CDN in front of the web server is highly effective because CDN edge nodes distribute traffic globally, cache static content, and reduce direct requests reaching the origin. This improves resilience and keeps origin capacity available for legitimate users. A WAF complements this by filtering malicious HTTP/S traffic patterns and enforcing rules (rate limiting, bot filtering, request validation) at the edge or in front of the service. Together, CDN + WAF align with Cloud+ CV0-004 objectives around designing secure, highly available architectures, implementing layered defenses, and using cloud-native services to mitigate attacks.

DLP focuses on preventing data exfiltration, not DDoS. Hardening reduces compromise risk but does not stop traffic floods. ACLs can restrict known bad sources but are limited against distributed botnets and may not scale fast enough for large attacks. Inline IDS is typically detection-focused and can become a bottleneck during volumetric events.