To protect a web application on AWS from network-layer DDoS attacks, which service should be used?

AWS Shield is the correct choice for protecting against network-layer (Layer 3 and 4) DDoS attacks. It's a managed DDoS protection service that safeguards applications running on AWS. AWS Shield Standard is automatically included for all AWS customers at no additional cost, offering protection against common, most frequent network and transport layer DDoS attacks. For more advanced protection, AWS Shield Advanced provides enhanced detection and mitigation for larger and more sophisticated attacks, as well as cost protection against scaling charges from DDoS-related spikes. AWS WAF (Web Application Firewall) protects against common web exploits (Layer 7) that could affect application availability, compromise security, or consume excessive resources. AWS Firewall Manager simplifies the administration and maintenance tasks across multiple accounts and resources for services like AWS WAF. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts and workloads.