2.3.1 DDoS Protection
Volumetric floods fill pipes. Application floods exhaust workers. Cloud shields and CDNs soak the first; WAF and rate limits handle the second.
Why it matters
Anyone can rent a botnet. A small origin dies in seconds without an edge.
How it is used
Hide origin IPs. Put a CDN/WAF in front. Rate-limit expensive routes. Have an “enable challenge / block country” runbook.