DoS and DDoS Attack Methods EHE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company's internet link is saturated with large UDP packets on port 123. The packets are responses from public NTP servers to a spoofed source IP address that belongs to the company's mail server. The mail server is not the source of the queries. Which action would most effectively reduce the impact?

   • AWork with the ISP to filter spoofed source IPs and deploy a DDoS mitigation service
   • BBlock all UDP port 123 traffic at the company's firewall
   • CDisable NTP on the mail server
   • DConfigure the mail server to ignore NTP responses
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is investigating a DDoS attack against a financial institution. The attack traffic originates from thousands of IoT devices, including cameras and routers, that have been compromised. The devices are sending a high volume of UDP packets to the institution's servers. What is the most effective way to reduce the attack's impact?

   • ADisable UDP on the institution's servers
   • BContact the ISP to shut down the IoT devices
   • CDeploy a DDoS mitigation service that can absorb and filter the traffic
   • DBlock the IP addresses of the compromised devices at the firewall
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A small ISP's core router becomes overloaded when it receives a continuous stream of ICMP echo request packets from many different source IP addresses. The router's CPU usage spikes, and legitimate traffic is delayed. The ISP wants to protect the router without disabling ICMP entirely. Which configuration is most appropriate?

   • AIncrease the router's memory
   • BEnable ICMP rate limiting on the router's interfaces
   • CDisable ICMP echo replies on the router
   • DBlock all ICMP traffic from the internet
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a common DDoS mitigation technique?

   • ADisabling all network firewalls
   • BIncreasing the number of open ports
   • CTraffic filtering to block malicious packets
   • DRemoving all security patches
   Reveal Solution Discussion Select an answer first
6. 30application · hard

   A gaming company's authoritative DNS servers are overwhelmed by a flood of large DNS responses. Analysis shows that the queries originate from many different IP addresses and target open DNS resolvers, which then send large responses to the company's servers. The company wants to reduce the impact while maintaining legitimate DNS resolution for its users. Which combination of actions is most effective?

   • ASwitch to a different DNS provider and disable recursion on the authoritative servers
   • BDeploy anycast DNS and increase authoritative server capacity
   • CConfigure rate limiting on the authoritative DNS servers and block traffic from known open resolvers
   • DEnable DNS response rate limiting (RRL) and use a DDoS protection service that filters malicious DNS traffic
   Reveal Solution Discussion Select an answer first