A company is concerned about DDoS attacks. Its web application runs on Amazon EC2 instances and serves static content (images and videos) from Amazon S3. A security engineer must design a resilient, cost-effective architecture that can withstand DDoS events. Which solution meets these requirements most cost-effectively?

The correct solution leverages multiple AWS services designed for high availability and DDoS mitigation. An Auto Scaling group ensures that the application can scale out to handle increased traffic during an attack, while an Elastic Load Balancer distributes traffic across healthy instances, preventing any single point of failure. CloudFront, a global content delivery network (CDN), caches static content from S3, reducing the load on EC2 instances and absorbing many common DDoS attack types at the edge. This combination provides a robust and cost-effective defense. The incorrect options are less effective or more expensive. Updating security groups via Lambda is a reactive and potentially disruptive measure that could block legitimate traffic. A warm standby disaster recovery environment is primarily for regional outages, not real-time DDoS mitigation, and is more costly. AWS Shield Advanced offers advanced protection but is a premium service, making it less cost-effective for the initial layer of defense compared to the proposed architecture.