Denial-of-Service and DDoS CEH Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security analyst is investigating a DDoS attack and discovers that the attack traffic is coming from a large number of IoT devices. The devices are sending DNS queries to open resolvers, which then send responses to the victim. The analyst also notices that the attack traffic is not spoofed; the source IPs are the actual IPs of the IoT devices. What is the most effective way to mitigate this attack?

   • ADeploy a DDoS protection service that can absorb the amplified traffic.
   • BContact the ISP to filter the attack traffic before it reaches the network.
   • CConfigure the victim's DNS servers to ignore queries from the IoT devices.
   • DBlock all DNS traffic from the IoT devices at the firewall.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security analyst is analyzing a DDoS attack and finds that the attack traffic consists of TCP packets with the ACK flag set, but the packets are not part of any established connection. The packets are sent to a web server, causing it to process them and consume CPU resources. The source IPs are spoofed. What is the best mitigation?

   • AEnable SYN cookies on the web server.
   • BBlock all TCP traffic from the spoofed source IPs.
   • CIncrease the web server's TCP buffer size.
   • DConfigure the firewall to drop TCP packets with the ACK flag that are not part of an established connection.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company's web application is under a sophisticated DDoS attack that uses a mix of SYN floods, UDP floods, and HTTP GET floods. The company has a cloud-based DDoS protection service, but the attack is still causing intermittent outages. The security team suspects that the protection service is not filtering some attack traffic. Which action should the team take first to improve the effectiveness of the protection?

   • AMove the application to a different cloud provider.
   • BIncrease the threshold for triggering the protection service's mitigation.
   • CReview the protection service's logs and adjust the filtering rules to better identify attack patterns.
   • DDisable the protection service and rely on the on-premises firewall.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is planning its DDoS incident response strategy. They have a critical web application and a limited budget. They want to ensure that the application remains available during a DDoS attack. Which approach should they prioritize?

   • ATrain all employees on DDoS mitigation techniques.
   • BPurchase the most expensive DDoS protection service available.
   • CDevelop a detailed incident response plan that includes roles, communication, and pre-approved mitigation actions.
   • DImplement a load balancer to distribute traffic across multiple servers.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team is investigating a DDoS attack that used a large number of IoT devices to send traffic to a target. The devices were infected with malware that connected to a command-and-control (C2) server. Which technique would be most effective in disrupting the botnet's ability to coordinate further attacks?

   • AIncrease the target's bandwidth to absorb the traffic.
   • BDeploy a firewall rule to drop all traffic from IoT devices.
   • CTake down the C2 server by working with the hosting provider.
   • DBlock the target's IP address at the ISP level.
   Reveal Solution Discussion Select an answer first