312-50 Question 241
Single answer▪ DoS/DDoS Protection ToolsA retail company is running a public e-commerce site behind a cloud-hosted reverse proxy/WAF. During a flash sale, the security team observes a large Layer 7 HTTP GET flood coming from thousands of rotating IP addresses. The requests look legitimate at the TCP level, but many clients repeatedly request dynamic search and cart endpoints, driving CPU utilization on the origin servers to 100%. The company wants to keep the site available for real shoppers while reducing the attack impact without blocking entire countries. Which control is the MOST appropriate to implement first using DoS/DDoS protection tools?
- A
Enable application-layer rate limiting and behavioral challenge mechanisms on the reverse proxy/WAF for the targeted URLs
- B
Disable SYN cookies on the edge firewall so the firewall can inspect full TCP handshakes before allowing traffic
- C
Block all inbound traffic from networks that do not belong to the company's ISP
- D
Increase the TTL value in DNS records so attackers cannot resolve the e-commerce site quickly
Show answer and explanation
Correct answer: A
Explanation
This is a classic Layer 7 DDoS scenario: the requests are distributed, complete normal TCP handshakes, and target resource-intensive dynamic pages. Best practice is to apply controls as close to the edge as possible using DDoS protection services, reverse proxies, or WAF platforms that support HTTP rate limiting, bot detection, request fingerprinting, managed challenges, and caching where appropriate. Guidance from major providers and industry best practices consistently separates volumetric/network-layer mitigations such as SYN flood defenses from application-layer mitigations such as per-URL rate limits and behavioral analysis. In CEH-style reasoning, the key is to match the protection tool to the attack layer: HTTP floods require application-aware defenses, not just packet-level filtering.
- A. Correct.
Correct. The scenario describes an application-layer HTTP GET flood using distributed sources and apparently valid TCP sessions. In this case, network-layer controls alone are insufficient because the attack consumes origin resources through expensive application requests. Enabling URL-specific rate limiting, bot mitigation, JavaScript/CAPTCHA-style behavioral challenges, and anomaly detection at the reverse proxy/WAF is an appropriate first response. These controls are designed to distinguish abusive request patterns from normal browsing and can protect dynamic endpoints such as search and cart functions while preserving availability for legitimate users.
- B. Incorrect.
Incorrect. SYN cookies are a defensive mechanism against TCP SYN flood attacks, not something to disable. The attack in the scenario is not a SYN flood; the requests complete the TCP handshake and then abuse the HTTP layer. Disabling SYN cookies would weaken protection against a different class of DoS attack and would not address excessive HTTP GET requests to dynamic application endpoints.
- C. Incorrect.
Incorrect. Blocking all traffic except networks belonging to the company's ISP would effectively deny service to most legitimate customers on the Internet. It is also not aligned with the stated requirement to keep the site available for real shoppers and avoid broad geographic blocking. This option reflects a common misconception that aggressive coarse filtering is an acceptable first response, when in reality it often causes self-inflicted denial of service.
- D. Incorrect.
Incorrect. DNS TTL controls caching duration for DNS records and can help with planned cutovers or traffic steering changes, but it does not prevent attackers from resolving a public hostname or mitigate an active application-layer flood. Raising TTL may reduce DNS query volume in some cases, but it does not address CPU exhaustion on origin servers caused by repeated dynamic HTTP requests.