312-50 Question 236
Single answer▪ DDoS Case StudyA retail company asks a CEH-certified security consultant to help analyze a recent outage. During the incident, the company’s web server CPU stayed below 20%, but the Internet link to the data center was fully saturated. NetFlow records showed a sudden spike of UDP traffic from thousands of geographically distributed IP addresses, mostly targeting random high-numbered destination ports on the public IP range. The firewall logs showed no successful application-layer sessions, and the ISP confirmed the traffic volume exceeded the organization’s circuit capacity. Which action would be the MOST effective immediate mitigation to restore availability while preserving evidence for later investigation?
- A
Enable more detailed logging on the web server and increase the application thread pool size
- B
Block the top offending source IP addresses on the perimeter firewall and reboot the firewall to clear states
- C
Coordinate with the ISP to apply upstream filtering or traffic scrubbing for the attack traffic while capturing relevant flow and log data
- D
Disable UDP on all internal servers and close unused services on the web server
Show answer and explanation
Correct answer: C
Explanation
This scenario matches a classic volumetric UDP flood case study: distributed sources, random high UDP destination ports, low server CPU, absence of completed application sessions, and a fully saturated Internet link. In such incidents, the bottleneck is the organization’s network capacity, so local server tuning or host-based changes do not restore availability. The correct immediate response is to work with the ISP or a DDoS mitigation provider to apply upstream controls such as ACL-based filtering, remotely triggered black hole routing where appropriate, or traffic scrubbing. At the same time, defenders should preserve telemetry such as NetFlow, firewall logs, packet captures, and incident timelines for forensic and lessons-learned purposes. This aligns with common DDoS response guidance from network operators and security best practices, including the principle that volumetric attacks must be mitigated as far upstream as possible because on-premises controls cannot protect a fully saturated circuit.
- A. Incorrect.
This is incorrect because the evidence indicates a volumetric network-layer or transport-layer DDoS, not an application resource exhaustion issue. The web server CPU is low, there are no successful application sessions, and the WAN circuit is saturated before traffic can be meaningfully processed by the server. Increasing the application thread pool or web-server logging does not address link saturation and may add unnecessary load.
- B. Incorrect.
This is incorrect because in a large distributed DDoS, blocking individual source IPs at the perimeter is usually ineffective and operationally expensive. Attack sources may be spoofed or too numerous to block one by one, and the bandwidth is already exhausted before the firewall can provide useful relief. Rebooting the firewall is also not a sound mitigation step and can disrupt legitimate connectivity without solving upstream congestion.
- C. Correct.
This is correct because when the organization’s Internet circuit is saturated, the most effective immediate mitigation is to stop or clean the traffic before it reaches the victim network. ISP-based upstream filtering, blackholing under controlled circumstances, or dedicated scrubbing services are standard responses to volumetric DDoS attacks. Preserving NetFlow, firewall logs, timestamps, and packet samples supports later investigation, post-incident analysis, and coordination with providers or law enforcement if needed.
- D. Incorrect.
This is incorrect because host-level hardening can reduce attack surface for some scenarios, but it does not solve the main problem here: upstream bandwidth exhaustion. The traffic is targeting random high UDP ports across the public range and exceeds circuit capacity, so even perfectly hardened internal servers would remain unreachable until the excess traffic is filtered before it fills the link.