1.7 Detect and Mitigate Common Types of Attacks CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A large e-commerce site is hit by a flood of UDP packets from thousands of different source IPs, saturating the uplink. The attack traffic is mostly large, fixed-size packets. The site's existing IPS is not dropping the traffic because it is stateless and the volume is overwhelming. What is the most effective immediate mitigation to preserve availability?

   • AIncrease the bandwidth of the internet connection
   • BEnable rate limiting on the edge router for UDP traffic
   • CBlackhole the victim's IP prefix at the upstream provider
   • DDeploy a stateful firewall to filter UDP packets
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is monitoring network traffic and notices a host sending DNS queries for a domain that is known to be a botnet command-and-control (C2) domain. The host is also communicating with other internal hosts on unusual ports. What is the best action to disrupt the botnet activity?

   • ABlock all outbound DNS traffic from the infected host
   • BDisconnect the host from the network immediately
   • CConfigure the firewall to drop all traffic to the C2 IP
   • DSinkhole the C2 domain by redirecting DNS queries to a controlled server
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company's web application is suffering from an attack that causes high CPU usage on the application servers. The attack traffic appears to be legitimate HTTP GET requests for a specific resource, but they are sent at a very high rate from a distributed set of IPs. The requests are not malformed and do not match any known signature. The company has a load balancer and an IPS. What is the most effective mitigation strategy?

   • AUse a web application firewall (WAF) with bot detection and challenge mechanisms
   • BDeploy rate limiting on the load balancer for the specific resource
   • CEnable deep packet inspection on the IPS to look for anomalies
   • DBlackhole the source IPs at the ISP
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A network security team is troubleshooting why their IPS is not detecting a known exploit. The exploit is delivered over HTTP, but the payload is split across multiple packets and the URL is encoded with %2e%2e (dot-dot) to represent directory traversal. The IPS has TCP reassembly enabled but still no alert. What is the most likely reason?

   • AThe IPS signature is outdated
   • BThe attacker is using IP spoofing to avoid detection
   • CThe IPS is not performing HTTP normalization on the reassembled stream
   • DThe IPS is not configured to inspect port 80
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security administrator is investigating a series of successful attacks on internal servers. The attacks appear to originate from internal IP addresses, but the administrator suspects spoofing. The network uses DHCP for IP assignment and has no authentication on the wired ports. Which combination of measures would best prevent IP spoofing and ARP poisoning?

   • AEnable port security with sticky MAC addresses and limit one MAC per port
   • BDeploy a firewall between the access layer and the core
   • CConfigure static ARP entries on all servers
   • DEnable DHCP snooping, Dynamic ARP Inspection (DAI), and IP Source Guard on all access ports
   Reveal Solution Discussion Select an answer first