N10-009 Question 263
Single answerDenial-of-service (DoS)/distributed denial-of-service (DDoS)A company hosts a public e-commerce website in its on-premises data center. During a flash sale, users report that the site is intermittently unavailable. Monitoring shows the internet circuit is saturated with a very large volume of traffic coming from thousands of different source IP addresses across multiple countries. The firewall and web servers are functioning normally, but legitimate HTTPS requests are timing out before they reach the application. Which action would BEST mitigate this attack while keeping the website available to customers?
- A
Enable account lockout policies on the web application to block repeated login attempts
- B
Contact the ISP to implement upstream traffic filtering or DDoS scrubbing for the targeted public service
- C
Reboot the firewall to clear existing sessions and restore normal traffic flow
- D
Disable TLS on the website to reduce CPU overhead on the web servers
Show answer and explanation
Correct answer: B
Explanation
The key clue is that the internet circuit is saturated by traffic from thousands of distributed source IP addresses and legitimate requests time out before they reach the servers. That points to a volumetric DDoS, not a server-side performance issue or a simple login attack. In these cases, the most appropriate mitigation is upstream intervention by the ISP or a dedicated DDoS mitigation service, because local firewalls and servers cannot effectively protect a service once the access circuit itself is overwhelmed. This aligns with common security and network operations best practices: mitigate as far upstream as possible, use ISP/provider coordination for public-service attacks, and preserve availability through traffic scrubbing or filtering rather than making local-only changes. Guidance from organizations such as CISA and NIST commonly emphasizes coordinated provider-based mitigation for DDoS incidents, especially when bandwidth exhaustion is involved.
- A. Incorrect.
This is incorrect. Account lockout policies address authentication abuse such as password guessing or credential-stuffing effects at the application layer, not a volumetric DDoS that is saturating the internet connection. In this scenario, the traffic is preventing legitimate requests from reaching the application at all, so changing login controls would not relieve the upstream bandwidth exhaustion.
- B. Correct.
This is correct. A volumetric DDoS generated from many distributed source IP addresses is best mitigated upstream, before it consumes the organization's internet circuit. ISPs and DDoS protection providers can use traffic filtering, rate limiting, blackholing/sinkholing when appropriate, or scrubbing centers to remove malicious traffic while forwarding legitimate traffic. This is the most effective action for preserving availability of a public-facing service during a distributed attack.
- C. Incorrect.
This is incorrect. Rebooting the firewall may temporarily interrupt service and does not solve the root cause of a saturated WAN link. Because the attack traffic is filling the circuit before legitimate traffic can arrive, restarting local equipment will not meaningfully reduce inbound attack volume. This distractor reflects a common but ineffective reaction to DoS events.
- D. Incorrect.
This is incorrect. Disabling TLS might reduce server processing overhead in some situations, but the scenario indicates the bottleneck is network saturation, not web server CPU utilization. Removing TLS would also weaken security and would not address the distributed traffic flood consuming the internet connection.