Belinda is designing an API-driven cloud communications platform.

The threats described exist at different layers, so the architecture should apply layered protection. WAF is the correct control for public HTTP/API traffic because it analyzes application-layer requests and blocks threats such as SQL injection, cross-site scripting, command injection, brute-force attacks, and other OWASP-style attacks. Alibaba Cloud explicitly supports integrating WAF with API Gateway and recommends disabling direct access paths afterward so clients cannot bypass WAF.

Large DDoS attacks require a dedicated volumetric mitigation service. Anti-DDoS Proxy scrubs malicious network and transport-layer traffic before clean traffic is forwarded toward the application infrastructure. Alibaba Cloud ' s Anti-DDoS architecture supports protected services behind Server Load Balancer resources and provides port-forwarding mechanisms for non-HTTP workloads.

Alibaba Cloud specifically recommends combining Anti-DDoS and WAF when an application needs protection against both large volumetric attacks and sophisticated application-layer exploits.

WAF should protect the HTTP/API application boundary rather than being treated as a general Layer-4 NLB firewall. Security Center provides workload security and posture management, while basic DDoS protection alone is less suitable for the question ' s explicitly stated large and sophisticated attacks.

Study Guide reference: Securing Workloads on Alibaba Cloud — WAF, Anti-DDoS, API Gateway security, and defense-in-depth.

==================================================