As I know about DDoS attack, there are three type of attacks: Volumetric, TCP State-Exhaustion and Application Layer Attack. From my point of view, the best way to use on premise and cloud scrubbing solution. To protect our public services from TCP State-Exhaustion and Application Layer attack using "on premise" DDoS protection solution and for the volumetric using cloud scrubbing. refer to this solution, we protect the public service and also internal network. This is good if our public service running our our DC, but if our services is running on the cloud, the best way is using DDoS cloud protection solution.