100-150 Question 258
Select 2A network administrator notices an unusual spike in traffic on a specific port of a company’s web server. Upon investigation, it is revealed that the traffic is part of a Distributed Denial of Service (DDoS) attack. Which of the following actions should the administrator prioritize to mitigate the attack and improve security?
- A
Enable Access Control Lists (ACLs) to block traffic from suspicious IP addresses.
- B
Shut down the affected server to prevent further damage.
- C
Implement rate limiting to restrict the number of requests per second from a single source.
- D
Analyze server logs to identify the source of the attack.
- E
Configure a firewall rule to block all incoming traffic to the server.
Show answer and explanation
Correct answers: A, C
Explanation
To effectively mitigate a DDoS attack, the administrator should focus on actions that reduce the malicious traffic without disrupting legitimate users. Enabling ACLs and implementing rate limiting are proactive measures that help manage and filter traffic, minimizing the impact of the attack while allowing legitimate traffic to continue. Other options either fail to address the immediate attack or disrupt legitimate traffic unnecessarily.
- A. Correct.
Enabling ACLs can help block traffic from specific IP addresses or ranges identified as part of the attack, effectively reducing the attack's impact.
- B. Incorrect.
Shutting down the server is not an ideal solution as it disrupts legitimate users and does not address the root cause of the attack.
- C. Correct.
Implementing rate limiting helps control the traffic load by limiting requests, which can reduce the effectiveness of the DDoS attack.
- D. Incorrect.
Analyzing server logs is important for forensic purposes but does not immediately mitigate the attack in progress.
- E. Incorrect.
Blocking all incoming traffic to the server would stop the attack but also prevent legitimate users from accessing the service, creating a denial of service for legitimate traffic.