312-50 Question 240
Single answer▪ DoS/DDoS Protection ToolsA retail company hosts its public e-commerce site behind a reverse proxy and notices intermittent outages during a promotional event. Monitoring shows a sudden surge of HTTP GET requests from thousands of geographically distributed IP addresses, each requesting the home page and product images at a low rate to avoid simple per-IP rate limits. The security team needs a protection approach that can absorb the traffic upstream and distinguish malicious HTTP flood behavior from legitimate shoppers without blocking all traffic from shared NAT networks. Which solution is the MOST appropriate?
- A
Deploy a cloud-based DDoS scrubbing service with behavioral analysis and CDN/WAF integration in front of the site
- B
Block all source IP addresses after 10 requests per minute at the local firewall
- C
Disable HTTP keep-alive on the web servers so each client must reconnect for every request
- D
Use SYN cookies on the web server to stop the HTTP GET flood
Show answer and explanation
Correct answer: A
Explanation
The key clues are: the attack is distributed across many IP addresses, it is application-layer HTTP GET traffic, and each source stays below simple rate thresholds. In this situation, the best practice is to use an upstream mitigation platform such as a cloud DDoS scrubbing provider, often combined with CDN caching and WAF protections, so malicious traffic is filtered before it consumes the victim's Internet link or edge resources. Modern DDoS defenses rely on behavioral analysis, anomaly detection, IP/domain reputation, challenge-response techniques, and traffic engineering rather than only static per-IP blocks. This aligns with common vendor and industry guidance from providers such as Cloudflare, Akamai, and AWS Shield, as well as general DDoS mitigation best practices from organizations like CISA and NIST: absorb traffic upstream, use layered defenses, and apply controls appropriate to the attack layer. The other options reflect common misconceptions: local firewall blocking is too coarse and too late for large DDoS events, disabling keep-alive harms normal performance without stopping the attack, and SYN cookies only help with TCP SYN floods, not HTTP GET floods.
- A. Correct.
Correct. A cloud-based DDoS scrubbing service is designed to absorb high-volume distributed attacks before they saturate the organization's Internet connection. When combined with CDN and WAF capabilities, it can use rate shaping, reputation, behavioral analysis, challenge mechanisms, and Layer 7 filtering to detect anomalous HTTP GET flood patterns while allowing legitimate traffic. This is especially appropriate when attackers use many distributed IPs at low rates, which defeats simple per-IP blocking.
- B. Incorrect.
Incorrect. A strict per-IP block at the local firewall is a common but ineffective response to distributed application-layer attacks. It can cause major false positives by blocking legitimate users behind carrier-grade NAT, enterprise proxies, or mobile networks. It also does not solve upstream bandwidth exhaustion because the attack traffic still reaches the victim's network before being filtered.
- C. Incorrect.
Incorrect. Disabling HTTP keep-alive may reduce some server-side resource persistence, but it does not meaningfully mitigate a distributed HTTP GET flood and can actually increase server and network overhead for legitimate users by forcing more TCP handshakes. This is not a primary DDoS protection strategy and does not address upstream saturation or intelligent Layer 7 attack filtering.
- D. Incorrect.
Incorrect. SYN cookies are a defense for TCP SYN flood attacks, which target the TCP handshake state table. The scenario describes an HTTP GET flood in which full TCP connections are established and valid-looking application requests are sent. SYN cookies do not address Layer 7 request floods.