Denial-of-Service and DDoS CEH Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company wants to minimize the impact of a DDoS attack on its public-facing web servers. They have a limited budget and want to implement a cost-effective measure that can be deployed quickly. Which action is most appropriate?

   • AMove the web servers to a different hosting provider.
   • BPurchase a dedicated DDoS mitigation appliance for the data center.
   • CConfigure the web server to limit the number of concurrent connections per IP and set short timeouts.
   • DDisable the web server's logging to reduce resource usage.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which network hardening measure helps prevent your systems from being used as DDoS amplifiers?

   • AEnabling source IP spoofing
   • BDisabling IP forwarding
   • CIncreasing the TTL on DNS records
   • DDisabling open DNS resolvers
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company is designing its DDoS incident response plan. The plan must balance the need to maintain service availability with the need to preserve forensic evidence for potential legal action. Which approach best achieves this balance?

   • AShut down the affected servers to preserve evidence and then analyze the attack.
   • BCollect network captures and logs in real time while applying targeted filtering to mitigate the attack.
   • CFocus solely on mitigating the attack and skip evidence collection to speed up recovery.
   • DImmediately block all suspicious traffic and then collect logs after the attack ends.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst notices a sudden spike in DNS queries from many different resolvers to the company's authoritative DNS server. The queries are for a single domain and are all of type ANY. The responses are much larger than the queries. The analyst suspects a reflection attack. Which defensive measure would be most effective in reducing the impact of this attack?

   • AMove the DNS server to a different IP address.
   • BRate-limit DNS responses per source IP and disable ANY queries if not needed.
   • CIncrease the server's bandwidth to absorb the traffic.
   • DConfigure the DNS server to ignore queries from non-recursive clients.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A hacktivist group announces a campaign against a financial institution. During the attack, the institution's public website becomes slow, but the internal network and customer databases remain unaffected. The attack traffic consists of HTTP GET requests for a single large webpage, each request coming from a different IP address. The requests appear to come from real browsers with valid headers. Which tool is most likely being used, and which countermeasure would be most effective?

   • AStress-testing tool like hping3; increase the web server's connection timeout.
   • BLOIC; block the source IPs at the firewall.
   • CHOIC; deploy a web application firewall with rate limiting and CAPTCHA challenges.
   • DBotnet with SYN flood; enable SYN cookies on the web server.
   Reveal Solution Discussion Select an answer first