312-50 Question 242
Single answer▪ DoS/DDoS Protection ToolsA retail company hosts its public web application on a single internet-facing Linux server. During a flash sale, the site becomes unavailable due to a volumetric SYN flood originating from thousands of spoofed IP addresses. The internal firewall and host-based protections are overwhelmed, and the security team must quickly restore availability while preserving legitimate customer traffic. Which option is the MOST effective protection approach in this scenario?
- A
Deploy an upstream cloud-based DDoS scrubbing service or CDN with SYN flood mitigation and traffic filtering before traffic reaches the origin server
- B
Install Fail2ban on the web server to block the attacking IP addresses after repeated failed requests
- C
Disable SYN cookies on the Linux server so the TCP stack can process connections faster under load
- D
Rely on robots.txt to discourage abusive clients and reduce automated traffic to the application
Show answer and explanation
Correct answer: A
Explanation
The key issue is attack location and scale. Because the SYN flood is volumetric and uses spoofed IP addresses, the best mitigation is to stop or absorb the traffic upstream rather than at the target host. This aligns with industry best practice from providers and standards bodies: volumetric and transport-layer DDoS attacks should be mitigated as far upstream as possible using ISP assistance, cloud scrubbing, or CDN-based DDoS protection. TCP SYN flood mitigation commonly includes SYN proxying, SYN cookies, rate limiting, and traffic scrubbing. Local tools such as Fail2ban can help with smaller, non-spoofed abuse cases, but they are not sufficient once bandwidth or state tables are overwhelmed. References consistent with this guidance include vendor DDoS mitigation documentation from major CDN/scrubbing providers, Linux TCP hardening guidance on SYN cookies, and NIST best practices on denial-of-service resilience and layered defensive architecture.
- A. Correct.
Correct. A volumetric SYN flood from thousands of spoofed sources is best handled upstream, before the traffic reaches the organization’s internet link or the origin host. Cloud-based DDoS protection and CDN scrubbing providers absorb large traffic volumes, validate TCP handshakes, rate-limit malicious patterns, and forward only cleaned traffic to the server. This is the most effective choice when local firewall and host controls are already saturated.
- B. Incorrect.
Incorrect. Fail2ban can be useful for certain abuse patterns, especially repeated authentication failures or application-layer attacks from identifiable IPs, but it is not an effective primary defense against large SYN floods that use spoofed addresses. In this scenario, the attack volume and source spoofing make reactive local IP blocking insufficient and potentially harmful.
- C. Incorrect.
Incorrect. SYN cookies are specifically designed to help a system withstand SYN flood attacks by avoiding excessive allocation of half-open connection state. Disabling them would weaken resilience rather than improve it. The option reflects a common misconception that removing protections improves performance under attack.
- D. Incorrect.
Incorrect. robots.txt is a voluntary standard for search engine crawlers and has no enforcement capability against malicious actors or botnets. Attack traffic involved in a DDoS event will not be deterred by robots.txt, so it provides no meaningful protection in this case.