312-50 Question 226
Single answer▪ DoS/DDoS ConceptsA company hosts a public web application behind a load balancer. During a sales event, the security team observes that thousands of geographically distributed hosts are sending what appear to be legitimate HTTP GET requests for the site's dynamic search page. Each source sends requests slowly enough to avoid simple per-IP rate limits, but collectively the application servers become CPU-bound and legitimate users experience severe delays. NetFlow data shows normal TCP handshakes and no obvious packet spoofing. Which action would be the MOST effective immediate mitigation for this attack pattern?
- A
Block all inbound ICMP traffic at the perimeter firewall
- B
Enable application-layer DDoS protection such as a CDN/WAF with behavioral rate limiting and challenge-response controls
- C
Disable SYN cookies on the load balancer so half-open connections are dropped faster
- D
Increase the TCP retransmission timeout on the web servers
- E
Filter all traffic with a source address outside the company's country
Show answer and explanation
Correct answer: B
Explanation
The key clue is that the traffic consists of valid HTTP GET requests with normal TCP handshakes and no reliance on spoofing, which points away from classic volumetric or SYN-based floods and toward an application-layer DDoS attack. In such attacks, adversaries often target computationally expensive endpoints such as search, login, or report-generation functions. Because each bot stays under per-IP thresholds, basic network ACLs and simple rate limits are often ineffective. Best-practice mitigation is to place filtering and traffic scrubbing as far upstream as possible using a CDN, WAF, or cloud DDoS protection platform that can apply behavioral analysis, bot detection, reputation scoring, request shaping, and challenge-response controls. This aligns with common guidance from major vendors and industry best practices, including using upstream DDoS mitigation for Layer 7 attacks, tuning application-specific rate limits, caching static and cacheable dynamic content where possible, and protecting expensive endpoints with anomaly detection and request validation.
- A. Incorrect.
Incorrect. Blocking ICMP may reduce exposure to certain reconnaissance or ICMP flood traffic, but the scenario describes a Layer 7 HTTP GET flood using valid TCP handshakes and legitimate-looking requests. ICMP filtering does not address application-layer resource exhaustion on the search page.
- B. Correct.
Correct. This is characteristic of an application-layer DDoS attack, where individually valid HTTP requests are distributed across many hosts to exhaust server-side resources. A CDN/WAF or dedicated DDoS protection service with behavioral analysis, request profiling, rate limiting based on session and reputation, and challenge-response mechanisms is the most effective immediate mitigation because it can distinguish abusive request patterns beyond simple per-IP thresholds and absorb traffic before it reaches origin servers.
- C. Incorrect.
Incorrect. SYN cookies are a defense for TCP SYN flood conditions involving large numbers of half-open connections. The scenario explicitly states that TCP handshakes are normal, which means this is not primarily a SYN flood. Disabling SYN cookies would weaken, not improve, resilience to connection-flood attacks.
- D. Incorrect.
Incorrect. TCP retransmission timeout tuning affects how the stack handles packet loss and retransmissions, not how the application processes high volumes of legitimate HTTP requests. It would not materially reduce CPU exhaustion caused by expensive dynamic page generation.
- E. Incorrect.
Incorrect. Geo-blocking may reduce some unwanted traffic in limited cases, but the attack is described as geographically distributed and public services often require broad accessibility. Country-based filtering is a coarse control and is not the most effective immediate mitigation for a distributed Layer 7 flood, especially if legitimate customers are also international.