DDoS Protection & Mitigation Flashcards

Which CDN DDoS protection strategy involves collaborating with upstream ISPs to filter attack traffic closer to its source?

Answer: Upstream filtering or ISP-level mitigation via BGP communities

By signaling upstream ISPs via BGP communities, attack traffic can be dropped at the ISP level before it reaches the CDN, reducing the burden on CDN infrastructure.

What is a 'DDoS protection SLA' and what key metric does it typically guarantee?

Answer: A contractual commitment defining maximum mitigation time and availability percentage during an attack

DDoS protection SLAs typically guarantee that mitigation will be activated within a defined time and that service availability will be maintained above a stated percentage during attacks.

How does the HTTP/2 rapid reset attack (CVE-2023-44487) differ from a standard HTTP GET flood?

Answer: It exploits HTTP/2 stream multiplexing by rapidly opening and canceling streams to overwhelm servers with minimal bandwidth

The rapid reset attack abuses HTTP/2 RST_STREAM frames to open many streams and immediately cancel them, generating massive server load with relatively little attacker bandwidth.

What is 'always-on' DDoS mitigation, and how does it differ from 'on-demand' mitigation?

Answer: Always-on routes all traffic through scrubbing continuously, while on-demand activates mitigation only when an attack is detected

Always-on mitigation provides zero-second activation time since traffic is always inspected, whereas on-demand introduces detection lag before mitigation kicks in.

Which type of DDoS attack specifically targets DNS infrastructure to make websites unreachable without overwhelming the web servers themselves?

Answer: DNS flood or DNS amplification attack targeting authoritative or recursive resolvers

DNS-targeted attacks overwhelm resolvers or authoritative nameservers, preventing domain resolution so users cannot reach the site even if web servers are healthy.

What mitigation technique does a CDN use to handle 'cache-busting' DDoS attacks that force cache misses on every request?

Answer: Request coalescing and query string normalization to reduce origin load

Request coalescing ensures only one origin request is made for concurrent cache misses, while query string normalization prevents trivial cache-busting via parameter variations.

In a post-attack DDoS incident review, which log data is most critical for understanding the attack vector?

Answer: Edge access logs showing request patterns, source IPs, user agents, and HTTP methods during the attack window

Edge access logs capture detailed traffic characteristics needed to identify attack signatures, source distribution, targeted endpoints, and the specific attack type.