Multi-layer defense architecture with internet traffic first filtered by a DDoS Shield (L3/L4), then inspected by a WAF with L7 rules, rate-limited, cached at a CDN edge, and load-balanced across multiple application servers.