DoS and DDoS Attack Methods EHE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An online booking system becomes unresponsive during a promotional campaign. The web server logs show a high number of POST requests to the booking endpoint, each from a different IP address, with complete TCP handshakes. The server's CPU usage is high, but network bandwidth is normal. Which mitigation is most appropriate?

   • AImplement rate limiting per IP address on the web application firewall
   • BImplement a Web Application Firewall (WAF) with bot detection and challenge mechanisms
   • CIncrease the number of application servers
   • DDeploy a CDN to cache the booking page
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is an effective countermeasure to reduce the impact of a DDoS attack?

   • ARemoving all rate limiting rules
   • BDisabling all security logging
   • CIncreasing the timeout for TCP connections
   • DUsing a content delivery network (CDN) to absorb and distribute traffic
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company's application server is experiencing slow responses during peak hours. The administrator suspects an application-layer DDoS attack, but the traffic appears to be legitimate HTTP requests from many different IPs. The requests are for a search endpoint that is CPU-intensive. The company has a CDN, but the CDN is not filtering the traffic. What is the most effective way to mitigate the attack while minimizing impact on legitimate users?

   • AUse a Web Application Firewall (WAF) with behavioral analysis to detect and block abnormal request patterns
   • BImplement a rate limit on the search endpoint per IP address
   • CAdd a CAPTCHA challenge for requests to the search endpoint
   • DConfigure the CDN to cache the search results
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which protocol is exploited in an ICMP flood attack?

   • AICMP
   • BUDP
   • CTCP
   • DHTTP
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company's firewall is overwhelmed by a flood of TCP SYN packets to a single server. The administrator has enabled SYN cookies on the server, but the firewall itself is now the bottleneck because it is processing a high volume of packets. What is the most effective way to protect the firewall and the server?

   • AIncrease the firewall's processing capacity
   • BDisable SYN cookies on the server
   • CBlock all TCP traffic to the server
   • DDeploy a DDoS mitigation service that can absorb the SYN flood before it reaches the firewall
   Reveal Solution Discussion Select an answer first