A security team requests protection against large network-layer DDoS attacks for critical supported public resources, along with enhanced response capabilities. Which AWS service should be evaluated?

1. Only a private hosted zone with a shorter TTL.
2. AWS Shield Advanced, alongside the application and network protection architecture.
3. Only a security group rule matching the HTTP request body.
4. Only S3 Transfer Acceleration for every network protocol.