312-50 Question 228
Single answer▪ DoS/DDoS ConceptsA company's public web application remains reachable during business hours, but users report severe slowdowns and intermittent timeouts. During a review, the security team sees a very high volume of TCP connection attempts from thousands of distributed IP addresses. Packet captures show many connections completing the TCP three-way handshake and then remaining idle or sending HTTP headers extremely slowly to keep sessions open. Server CPU usage is moderate, but the web server's connection pool is consistently exhausted. Which action would BEST mitigate this attack while preserving access for legitimate users?
- A
Block all inbound ICMP traffic at the firewall
- B
Enable SYN cookies only on the web server
- C
Deploy a reverse proxy or load balancer with connection rate limiting, aggressive idle/header timeouts, and per-client connection controls
- D
Increase the web server's TCP backlog queue and ephemeral port range only
Show answer and explanation
Correct answer: C
Explanation
This scenario describes a distributed denial-of-service condition focused on exhausting application or web server connection resources rather than saturating bandwidth or exploiting half-open TCP state. The indicators are: many distributed IPs, completed TCP handshakes, idle connections, and very slow HTTP header transmission. Those signs align with low-and-slow HTTP DoS techniques that consume server connection slots, worker threads, or request-processing capacity.
The best mitigation is to place a protective layer in front of the origin server that can enforce behavior-based controls such as connection limits, header/body read timeouts, idle session termination, and rate limiting. In practice, these controls are commonly implemented on reverse proxies, load balancers, WAFs, or CDN-based DDoS protection platforms. Vendor and project documentation for web servers and proxies such as NGINX, HAProxy, Apache HTTP Server, and cloud DDoS services commonly recommend timeout tuning and connection/request limiting against Slowloris-like attacks.
Why the other options are weaker: ICMP filtering is irrelevant to an HTTP/TCP connection exhaustion attack; SYN cookies help with SYN floods, not fully established slow HTTP attacks; and capacity increases alone may help performance temporarily but do not remove the attacker's ability to monopolize connections. From a CEH perspective, distinguishing volumetric floods, protocol-state attacks, and application-layer DoS is essential to selecting the correct mitigation.
- A. Incorrect.
Incorrect. Blocking ICMP may reduce exposure to certain ICMP-based flood techniques, but the scenario describes application-layer and connection-exhaustion behavior over TCP/HTTP. The attack traffic completes the TCP handshake and then abuses HTTP session handling, so filtering ICMP would not address the root cause.
- B. Incorrect.
Incorrect. SYN cookies are useful primarily against TCP SYN flood attacks that attempt to exhaust half-open connection state before the three-way handshake completes. In this scenario, the attacker is completing the handshake and then holding connections open or trickling HTTP headers slowly, which bypasses the main protection SYN cookies provide.
- C. Correct.
Correct. The symptoms match a distributed low-and-slow HTTP/connection exhaustion attack, similar in effect to Slowloris-style behavior. A reverse proxy, WAF, CDN edge, or load balancer that enforces strict header read timeouts, idle connection timeouts, request rate limits, and per-client connection caps can absorb or terminate abusive sessions before they consume origin server worker threads or connection slots. This approach targets the actual resource being exhausted while maintaining service for legitimate traffic.
- D. Incorrect.
Incorrect. Increasing backlog queues or ephemeral port ranges may provide temporary headroom, but it does not mitigate the attack logic. Because the attacker completes connections and then keeps them open, simply adding capacity can delay failure without solving the connection pool exhaustion problem. It is a tuning measure, not the best primary mitigation.