DoS and DDoS Attack Methods EHE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A gaming company's authoritative DNS servers are overwhelmed by a flood of large DNS responses. The responses are coming from many unrelated public DNS servers, and the queries appear to be for a single domain with a large TXT record. The company's own DNS servers are not the source. What is the most likely attack and the best immediate mitigation?

   • ADNS amplification; configure the company's DNS servers to ignore queries from non-authenticated sources
   • BDNS reflection; block all UDP port 53 traffic at the company's firewall
   • CDNS amplification; contact upstream ISPs to filter spoofed source IPs and use a DDoS protection service
   • DDNS amplification; deploy rate limiting on the company's edge firewall for DNS response traffic
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A small e-commerce company's web server becomes unresponsive. The administrator checks the server and finds thousands of half-open TCP connections in the SYN_RECEIVED state, consuming the connection table. The source IPs appear randomized. Which immediate mitigation is most effective while preserving legitimate access?

   • AEnable SYN cookies on the server's TCP stack
   • BBlock all ICMP echo requests at the firewall
   • CIncrease the server's backlog queue size
   • DDisable TCP timestamps on the server
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A news website is experiencing slow response times. The web server logs show many connections that send partial HTTP headers and then remain idle, tying up worker threads. The source IPs are numerous and appear to be from a botnet. The traffic volume is low, and bandwidth is not saturated. Which countermeasure would be most effective?

   • AEnable HTTP compression on the web server
   • BIncrease the web server's maximum number of worker threads
   • CConfigure a shorter timeout for incomplete HTTP requests
   • DBlock all incoming traffic from the botnet's IP addresses
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An online retailer's application server becomes slow during a marketing campaign. The server logs show a high volume of legitimate-looking GET requests for the product catalog page, each from a different IP address. The requests are not malformed, and the server's CPU is pegged. The network bandwidth is not saturated. Which mitigation is most appropriate?

   • AImplement a CAPTCHA challenge for requests that exceed a threshold
   • BUse a CDN with DDoS protection that can absorb and filter application-layer floods
   • CAdd more web servers behind a load balancer
   • DDeploy a Web Application Firewall (WAF) with rate limiting per IP
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the key mechanism behind a DNS amplification attack?

   • ASending small DNS queries to open resolvers with a spoofed source IP, causing large responses to be sent to the victim
   • BSending large DNS queries to the victim's DNS server
   • CSending DNS queries with malformed headers to crash the server
   • DSending DNS queries to the victim's server to exhaust its CPU
   Reveal Solution Discussion Select an answer first