DDoS Protection & Mitigation Flashcards

What is a 'reflection amplification' DDoS attack?

Answer: An attack that spoofs the victim's IP to trigger large responses from third-party servers

Reflection amplification attacks spoof the victim's source IP to send small requests to open resolvers, which then flood the victim with large responses.

Which DNS-based technique does a CDN use to redirect traffic through DDoS scrubbing infrastructure?

Answer: DNS-based traffic steering that points the domain to CDN proxy IPs

By pointing the target domain's DNS records to CDN-controlled IPs, all traffic passes through the CDN's scrubbing and mitigation layer before the origin.

What is 'BGP blackholing' in DDoS mitigation?

Answer: Announcing a route that drops all traffic to an attacked IP prefix at upstream routers

BGP blackholing routes all traffic destined for the victim's IP to a null route, stopping the attack at the cost of also dropping legitimate traffic.

How does 'IP reputation filtering' contribute to DDoS mitigation in a CDN?

Answer: It blocks requests from IPs known to be associated with botnets or past attacks

IP reputation databases track known malicious IPs; the CDN automatically drops traffic from these sources before further processing.

A 'low-and-slow' DDoS attack is most effective at bypassing which type of protection?

Answer: Volumetric threshold-based rate limiting

Low-and-slow attacks send traffic just below volume thresholds, avoiding detection by systems that only trigger on high packet or request rates.

Which CDN feature specifically helps mitigate NTP amplification attacks?

Answer: Blocking UDP traffic on port 123 at the edge or rate-limiting NTP responses

NTP amplification uses UDP port 123; blocking or rate-limiting this port at CDN edge nodes prevents the amplified traffic from reaching the origin.

What role does 'traffic baselining' play in automated DDoS detection on a CDN?

Answer: It establishes normal traffic patterns so anomalies can trigger mitigation automatically

By learning what normal traffic looks like, a CDN can detect statistical deviations that indicate an attack and engage mitigation without manual intervention.