DDoS Protection & Mitigation Flashcards

What is the primary advantage of using a CDN's distributed network for DDoS mitigation over a single on-premise scrubbing appliance?

Answer: The CDN's aggregate bandwidth across all PoPs far exceeds what any single appliance can absorb

A global CDN may have terabits of aggregate capacity spread across hundreds of PoPs, making it far better suited to absorb massive volumetric DDoS attacks than any single device.

Which Layer 7 DDoS attack sends incomplete HTTP POST requests to keep server connections open indefinitely?

Answer: RUDY (R-U-Dead-Yet) slow POST attack

RUDY sends HTTP POST requests with a very large declared content length but drips data byte-by-byte, exhausting server connection pools without triggering high-volume detection.

How does 'connection rate limiting' at a CDN edge node differ from 'request rate limiting'?

Answer: Connection rate limiting restricts new TCP connections per IP, while request rate limiting limits HTTP requests per IP over time

Connection rate limiting targets the TCP handshake layer to stop SYN floods, while request rate limiting operates at the HTTP layer to stop application-level floods.

What is 'geographic-based blocking' and when would a CDN operator use it during a DDoS attack?

Answer: Dropping all traffic from specific countries or regions identified as the primary attack source

When attack traffic originates overwhelmingly from specific regions, blocking those geographies at the CDN edge can significantly reduce attack volume at the cost of blocking legitimate users from those areas.

Which protocol characteristic makes UDP more susceptible to amplification DDoS attacks than TCP?

Answer: UDP is connectionless and does not require a handshake, making source IP spoofing trivial

Because UDP has no connection establishment, attackers can forge source IPs freely, enabling them to redirect amplified responses from reflectors to any victim.

A CDN implements 'token bucket' rate limiting. What happens when a client's token bucket is empty?

Answer: Subsequent requests are dropped or queued until the bucket refills at a configured rate

In the token bucket algorithm, each request consumes a token; when the bucket is empty, excess requests are dropped or queued until tokens regenerate at the refill rate.

What is 'SYN cookie' protection and how does it help a CDN mitigate SYN flood attacks?

Answer: The server encodes connection state in the SYN-ACK sequence number, eliminating the need to store half-open connections

SYN cookies encode session state cryptographically in the sequence number, so the server does not allocate memory for half-open connections until the client completes the handshake.