A city runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). Users report sporadic performance issues that appear related to DDoS attacks from random IP addresses. The city wants a solution that requires minimal configuration changes and provides an audit trail for the DDoS sources. Which solution meets these requirements?

AWS Shield Advanced is the correct solution because it provides comprehensive DDoS protection for applications, including proactive detection and mitigation of large and sophisticated attacks. It also offers 24/7 access to the AWS DDoS Response Team (DRT), who can integrate mitigating controls and provide an audit trail of attack details. This meets the requirement for minimal configuration changes as Shield Advanced integrates directly with existing AWS resources like ALBs. Enabling an AWS WAF web ACL on the ALB alone is insufficient for sophisticated DDoS attacks as WAF primarily protects against common web exploits and can be overwhelmed by high-volume attacks. Subscribing to Amazon Inspector is incorrect because Inspector is a security assessment service that identifies vulnerabilities, not a DDoS protection service. Creating a CloudFront distribution with WAF is a good practice for web