Denial-of-Service and DDoS CEH Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security analyst is investigating a DDoS attack that used a botnet of compromised web servers to send HTTP requests to a target. The analyst discovers that the botnet is using a peer-to-peer (P2P) C2 mechanism, making it difficult to shut down. Which mitigation strategy would be most effective in disrupting this botnet?

   • AUse content filtering to block HTTP requests from known botnet IPs.
   • BWork with ISPs to sinkhole the botnet's communication by redirecting traffic to a server the analyst controls.
   • CIncrease the target's bandwidth to absorb the attack.
   • DIdentify and take down the central C2 server.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company's network is experiencing a DDoS attack that is saturating their internet link. The attack is a mix of UDP and ICMP floods. The company has a DDoS protection service, but the service is not activated. What should the company do first?

   • AShut down the affected servers to prevent damage.
   • BContact the ISP to block the attack traffic.
   • CImplement on-premises rate limiting to reduce the attack traffic.
   • DActivate the DDoS protection service to reroute traffic through the scrubbing center.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which mitigation technique involves limiting the rate of traffic from a specific source to prevent overwhelming a server?

   • AEncryption
   • BLoad balancing
   • CTraffic filtering
   • DRate limiting
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A regional e-commerce site experiences intermittent outages during peak shopping hours. Network logs show a flood of TCP SYN packets to the web server from thousands of distinct source IPs, but each source sends only a few packets. The server's connection table fills up, and legitimate users cannot establish new sessions. Which mitigation approach should the security team implement FIRST to restore service while minimizing impact on legitimate traffic?

   • ABlock all TCP port 80 traffic at the firewall until the attack subsides.
   • BEnable SYN cookies on the server and configure the perimeter firewall to rate-limit new TCP connections per source IP.
   • CIncrease the server's TCP backlog queue size to accommodate more half-open connections.
   • DDeploy an on-premises intrusion prevention system to drop packets with invalid TCP flags.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company's website is under an application-layer DDoS attack that sends HTTP requests with a very high rate of unique User-Agent strings. The attack is causing high CPU usage on the web servers. The company has a WAF, but the WAF's default rules are not blocking the attack. What should the security team do?

   • ABlock all traffic with User-Agent strings that are not in a known list of legitimate browsers.
   • BIncrease the web server's CPU capacity to handle the load.
   • CCreate a custom WAF rule to block requests with a high rate of unique User-Agent strings.
   • DEnable the WAF's bot management feature, which uses behavioral analysis to identify and block automated traffic.
   Reveal Solution Discussion Select an answer first