312-50 Question 238
Single answer▪ DoS/DDoS Attack CountermeasuresA company hosts a public e-commerce site behind a traditional stateful firewall. During a flash sale, the site becomes intermittently unavailable. Monitoring shows a massive spike of half-open TCP connections from thousands of distributed source IP addresses, exhausting the web servers' connection backlog. Legitimate customers can still reach the network, but many sessions time out before completing the TCP handshake. As the security engineer, which countermeasure would MOST directly reduce the impact of this attack while preserving normal customer access?
- A
Enable SYN cookies on the web servers and tune the TCP SYN backlog
- B
Disable ICMP responses on the perimeter firewall
- C
Block all traffic from countries not associated with current customers
- D
Require all customers to connect through a VPN before accessing the site
Show answer and explanation
Correct answer: A
Explanation
This scenario is a classic TCP SYN flood DoS/DDoS condition: many distributed hosts send SYN packets, the server allocates state for half-open connections, and the backlog fills before the final ACK arrives. A direct countermeasure is to enable SYN cookies so the server can validate handshake completion before committing significant resources. Tuning backlog parameters may also help absorb bursts. This aligns with long-standing TCP/IP hardening guidance and operating-system/network-stack best practices for mitigating SYN flood attacks. In contrast, options such as disabling ICMP or imposing VPN access are either unrelated to the attack mechanism or operationally unsuitable for a public-facing service. Geo-blocking can sometimes be part of a broader DDoS response strategy, but it is not the most direct fix for half-open TCP connection exhaustion.
- A. Correct.
Correct. The scenario describes a SYN flood, where attackers send large numbers of SYN packets and do not complete the handshake, leaving many half-open connections that consume backlog resources. Enabling SYN cookies helps the server avoid allocating full connection state until the handshake is validated, and increasing or tuning the SYN backlog can further improve resilience. This is a direct and well-established mitigation for TCP SYN flood conditions while still allowing legitimate users to complete connections.
- B. Incorrect.
Incorrect. Disabling ICMP may reduce some reconnaissance or certain ICMP-based abuse, but it does not directly address exhaustion caused by half-open TCP connections in a SYN flood. In many environments, indiscriminately blocking ICMP can also hinder troubleshooting and path MTU discovery, creating operational problems without solving the stated issue.
- C. Incorrect.
Incorrect. Geo-blocking may reduce some unwanted traffic in specific business cases, but the attack is distributed across many source IP addresses and the question asks for the countermeasure that most directly addresses the observed mechanism. Attack traffic may also originate from allowed regions or through compromised hosts worldwide. This is an indirect filter, not the primary technical mitigation for SYN backlog exhaustion.
- D. Incorrect.
Incorrect. Forcing all customers to use a VPN would create major usability and scalability issues for a public e-commerce site and does not represent a practical primary countermeasure for this attack. It would likely reduce legitimate access more than attack traffic and shift the DoS pressure to the VPN infrastructure.