Denial-of-Service and DDoS CEH Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company's website is under an HTTP flood attack. The attack traffic appears to come from many different IP addresses, and each request asks for a different URL that returns a 404 error. The company's web server logs show a high rate of 404 responses. Which mitigation technique would be most effective in this scenario?

   • ABlock all requests that return a 404 error.
   • BUse a web application firewall to detect and block requests with unusual patterns, such as high 404 rates.
   • CConfigure the web server to rate-limit requests per IP address.
   • DIncrease the web server's connection timeout to keep connections open longer.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company's network is under a DDoS attack that is saturating the internet link. The company has a firewall that can filter traffic based on IP addresses and ports. Which immediate action is most likely to reduce the impact of the attack?

   • ADisable the firewall to reduce latency.
   • BRate-limit traffic on the affected ports.
   • CIncrease the firewall's logging level to capture more data.
   • DBlock all traffic from the attacking IPs.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary purpose of 'stress-testing' tools in the context of DDoS?

   • ATo identify vulnerabilities in web applications
   • BTo encrypt network traffic
   • CTo monitor network performance in real time
   • DTo evaluate the resilience of a network or service under heavy load
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which type of DDoS attack is characterized by overwhelming a target with a massive volume of traffic, such as UDP floods?

   • AVolumetric attack
   • BAmplification attack
   • CApplication-layer attack
   • DProtocol attack
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security analyst notices that a large number of IoT devices on the internet are sending traffic to a single IP address. The traffic consists of small UDP packets to port 53, and the source IPs are spoofed to be the target's IP. The analyst suspects a DDoS attack is being launched using these devices. What is the most accurate description of this attack?

   • AThe IoT devices are performing a low-and-slow application-layer attack.
   • BA botnet is performing a DNS amplification attack using open resolvers.
   • CThe attack is a SYN flood from a botnet of IoT devices.
   • DThe IoT devices are directly flooding the target with UDP packets.
   Reveal Solution Discussion Select an answer first