312-50 Question 237
Single answer▪ DoS/DDoS Attack CountermeasuresA public-facing e-commerce site is experiencing intermittent outages during peak traffic hours. Monitoring shows a very high volume of TCP SYN packets from many distributed source IP addresses, while the number of completed TCP handshakes remains unusually low. The security team must implement an immediate countermeasure that reduces the impact on the web servers without blocking legitimate customers. Which action is the MOST appropriate first response?
- A
Enable SYN cookies on the internet-facing systems and upstream load balancers/firewalls that support them
- B
Block all inbound TCP traffic temporarily at the perimeter firewall until the traffic spike ends
- C
Disable TCP three-way handshakes on the web servers to prevent half-open connections
- D
Configure port security on the internal access switches connected to employee workstations
Show answer and explanation
Correct answer: A
Explanation
This is a classic TCP SYN flood DoS/DDoS pattern: attackers send large numbers of SYN packets, forcing the target to allocate resources for half-open connections while never completing the handshake. A practical first-line mitigation is to enable SYN cookies or equivalent SYN flood protection on internet-facing systems and supported upstream devices, because this specifically addresses backlog exhaustion while preserving service for legitimate users. In real environments, teams often combine this with rate limiting, upstream filtering, load balancer protections, CDN/DDoS scrubbing services, and tuning of connection queues. Guidance from common TCP/IP hardening practices and vendor DDoS mitigation documentation consistently identifies SYN cookies and SYN flood protection mechanisms as appropriate countermeasures for this attack type.
- A. Correct.
Correct. The scenario describes a SYN flood: many SYNs, few completed handshakes, and distributed sources. Enabling SYN cookies is a well-established mitigation that helps systems handle large numbers of half-open TCP connection attempts without exhausting the SYN backlog. Applying this on exposed hosts and supported network devices is an effective immediate countermeasure that still allows legitimate clients to complete connections.
- B. Incorrect.
Incorrect. Blocking all inbound TCP traffic would stop the attack traffic, but it would also deny service to legitimate customers, which conflicts with the requirement to reduce impact without blocking normal users. This is an overly disruptive response rather than a targeted mitigation.
- C. Incorrect.
Incorrect. TCP's three-way handshake is fundamental to normal TCP connection establishment and cannot simply be disabled as a practical defense. The misconception is that removing the handshake would remove half-open states, but doing so would break standard TCP-based web services rather than mitigate the attack.
- D. Incorrect.
Incorrect. Port security on internal access switches is used to limit MAC addresses or control endpoint behavior on switch ports, helping with local network access control. It does not mitigate a distributed external SYN flood targeting public web infrastructure.