312-50 Question 234
Single answer▪ DDoS Case StudyA financial services company asks an ethical hacker to review a recent DDoS incident as part of a post-attack case study. During the outage, the public web application became unreachable, the upstream Internet link was saturated, and firewall logs showed hundreds of thousands of short-lived TCP connection attempts from widely distributed IP addresses. The security team initially increased the web server's CPU and memory, but the outage continued. Which action would have been the MOST effective immediate mitigation during this attack?
- A
Scale up the web server vertically by adding more CPU and RAM to handle the increased traffic load
- B
Engage the ISP or cloud DDoS protection provider to implement upstream traffic scrubbing and filtering before the traffic reaches the company edge
- C
Disable TLS on the web application to reduce cryptographic overhead on the server during the attack
- D
Block the top 20 attacking IP addresses on the local firewall and continue monitoring
Show answer and explanation
Correct answer: B
Explanation
This scenario reflects a classic DDoS case study outcome: the organization focused on host-level scaling while the actual bottleneck was network bandwidth exhaustion caused by a distributed flood of TCP connection attempts. In such cases, local actions like tuning the web server or blocking a handful of IPs are insufficient because the attack traffic has already consumed the available upstream capacity. CEH candidates should recognize that immediate mitigation for volumetric or large distributed floods typically requires upstream controls such as ISP coordination, cloud-based DDoS protection, traffic scrubbing, rate limiting, or provider-side blackholing/filtering where appropriate. Guidance from industry best practices, including DDoS mitigation recommendations from major providers and organizations such as CISA and NIST, consistently emphasizes that bandwidth-saturating attacks must be mitigated as far upstream as possible.
- A. Incorrect.
Incorrect. Adding CPU and RAM may help with some application-layer load issues, but it does not solve a volumetric or large-scale distributed attack when the upstream Internet circuit is already saturated. In the scenario, the key indicator is that the upstream link was exhausted before the traffic could be effectively processed by the local infrastructure.
- B. Correct.
Correct. When a DDoS attack saturates the organization's Internet connection, the most effective immediate response is upstream mitigation through the ISP, CDN, or dedicated DDoS protection service. Traffic scrubbing centers and provider-side ACLs/filters can remove malicious traffic before it consumes the victim's bandwidth. This is a standard best practice for volumetric and large distributed TCP flood scenarios.
- C. Incorrect.
Incorrect. Disabling TLS might reduce some server-side processing overhead, but it does not address the root problem described here: link saturation and distributed connection flooding. It could also weaken security and expose users to additional risk. This option reflects the misconception that all DDoS incidents are primarily a server resource problem.
- D. Incorrect.
Incorrect. Blocking a small number of source IPs on the local firewall is rarely effective against a true distributed denial-of-service event involving many spoofed or widely distributed hosts. In addition, local firewall filtering still occurs after the traffic has already traversed the saturated upstream connection, so the bandwidth exhaustion remains unresolved.