300-445 Question 208
Select 2An enterprise network is experiencing significant degradation in performance and intermittent outages. Upon investigation, the network team identifies unusual inbound traffic patterns from multiple global IP addresses targeting a specific server, as well as unexpected changes in DNS records redirecting traffic to malicious servers. Which two security issues are most likely causing these symptoms?
- A
Distributed Denial-of-Service (DDoS) attack
- B
DNS hijacking
- C
BGP hijacking
- D
Route leaking
- E
Internal misconfiguration
Show answer and explanation
Correct answers: A, B
Explanation
The symptoms described point to a combination of a DDoS attack and DNS hijacking. The unusual inbound traffic pattern is characteristic of a DDoS attack, which aims to overwhelm a server's resources, while the unexpected DNS record changes indicate DNS hijacking, where malicious actors redirect traffic to rogue servers. These two security issues directly affect network performance and align with the observed symptoms.
- A. Correct.
Distributed Denial-of-Service (DDoS) attacks involve overwhelming a server or network with excessive traffic, often from multiple sources, which matches the unusual inbound traffic pattern observed.
- B. Correct.
DNS hijacking involves unauthorized changes to DNS records, causing traffic redirection to malicious servers, which aligns with the unexpected DNS record changes identified.
- C. Incorrect.
BGP hijacking involves manipulating BGP routes to divert internet traffic, but this scenario does not mention BGP route anomalies or traffic redirection at the routing level.
- D. Incorrect.
Route leaking occurs when routing information is improperly shared between networks, leading to potential performance issues, but this scenario does not describe route-sharing issues.
- E. Incorrect.
Internal misconfiguration could cause performance degradation, but there is no indication in the scenario of misconfigured systems or devices within the enterprise network.