DDoS Protection & Mitigation Flashcards

Which DDoS attack type targets the SSL/TLS handshake process to exhaust server CPU resources?

Answer: SSL flood

SSL floods force repeated TLS handshakes, consuming significant CPU on the server side since cryptographic operations are computationally expensive.

What is a 'scrubbing center' in the context of CDN-based DDoS mitigation?

Answer: A centralized facility that filters malicious traffic before forwarding clean traffic to the origin

Scrubbing centers are specialized facilities that absorb, analyze, and clean attack traffic, forwarding only legitimate requests to the origin server.

During a volumetric DDoS attack, which CDN mechanism helps absorb traffic by distributing it across many PoPs?

Answer: Anycast routing

Anycast routing directs incoming traffic to the nearest PoP, spreading volumetric attack load across the CDN's global network capacity.

What distinguishes a protocol attack from a volumetric DDoS attack?

Answer: Protocol attacks exploit weaknesses in Layer 3/4 protocols rather than overwhelming bandwidth

Protocol attacks exploit flaws in TCP/IP stack behavior (e.g., SYN floods) to exhaust connection tables, whereas volumetric attacks simply flood bandwidth.

A CDN detects 10,000 requests per second from a single IP to one endpoint. What mitigation action is most appropriate?

Answer: Rate limit and block that IP at the edge

Rate limiting and blocking the offending IP at the CDN edge prevents the attack traffic from ever reaching the origin server.

What is the purpose of a challenge page (CAPTCHA) in CDN DDoS defense?

Answer: To verify that a client is a human browser before granting access during an attack

Challenge pages present a CAPTCHA or JavaScript test that human users can pass but automated bots typically cannot, filtering out bot-driven DDoS traffic.

Which metric best indicates that a CDN's DDoS mitigation is successfully protecting the origin?

Answer: Origin server response time and error rate remain normal despite elevated CDN traffic

If the origin's response time and error rate stay normal while CDN traffic spikes, mitigation is absorbing the attack without impacting legitimate users.