CDN DDoS Protection & Mitigation 2 — Questions and Answers
Question 1: Which DDoS attack type targets the SSL/TLS handshake process to exhaust server CPU resources?
- SSL flood (Correct answer)
- UDP amplification
- HTTP slowloris
- ICMP smurf
Correct answer: SSL flood
SSL floods force repeated TLS handshakes, consuming significant CPU on the server side since cryptographic operations are computationally expensive.
Question 2: What is a 'scrubbing center' in the context of CDN-based DDoS mitigation?
- A centralized facility that filters malicious traffic before forwarding clean traffic to the origin (Correct answer)
- A data center optimized for caching static content
- A monitoring dashboard for real-time attack visualization
- A distributed network of honeypots that attract attackers
Correct answer: A centralized facility that filters malicious traffic before forwarding clean traffic to the origin
Scrubbing centers are specialized facilities that absorb, analyze, and clean attack traffic, forwarding only legitimate requests to the origin server.
Question 3: During a volumetric DDoS attack, which CDN mechanism helps absorb traffic by distributing it across many PoPs?
- Anycast routing (Correct answer)
- Origin shielding
- Edge caching
- HTTP/2 multiplexing
Correct answer: Anycast routing
Anycast routing directs incoming traffic to the nearest PoP, spreading volumetric attack load across the CDN's global network capacity.
Question 4: What distinguishes a protocol attack from a volumetric DDoS attack?
- Protocol attacks exploit weaknesses in Layer 3/4 protocols rather than overwhelming bandwidth (Correct answer)
- Protocol attacks only target HTTP traffic while volumetric attacks target all protocols
- Protocol attacks are always smaller in scale than volumetric attacks
- Protocol attacks require botnets while volumetric attacks use amplification only
Correct answer: Protocol attacks exploit weaknesses in Layer 3/4 protocols rather than overwhelming bandwidth
Protocol attacks exploit flaws in TCP/IP stack behavior (e.g., SYN floods) to exhaust connection tables, whereas volumetric attacks simply flood bandwidth.
Question 5: A CDN detects 10,000 requests per second from a single IP to one endpoint. What mitigation action is most appropriate?
- Rate limit and block that IP at the edge (Correct answer)
- Increase origin server capacity
- Enable HTTP/2 push for that endpoint
- Disable caching for that endpoint
Correct answer: Rate limit and block that IP at the edge
Rate limiting and blocking the offending IP at the CDN edge prevents the attack traffic from ever reaching the origin server.
Question 6: What is the purpose of a challenge page (CAPTCHA) in CDN DDoS defense?
- To verify that a client is a human browser before granting access during an attack (Correct answer)
- To serve cached content faster during high load
- To block all traffic from suspicious ASNs
- To reroute traffic through scrubbing centers automatically
Correct answer: To verify that a client is a human browser before granting access during an attack
Challenge pages present a CAPTCHA or JavaScript test that human users can pass but automated bots typically cannot, filtering out bot-driven DDoS traffic.
Question 7: Which metric best indicates that a CDN's DDoS mitigation is successfully protecting the origin?
- Origin server response time and error rate remain normal despite elevated CDN traffic (Correct answer)
- CDN edge cache hit ratio increases during the attack
- Total bandwidth consumed at the CDN drops to zero
- Number of BGP route advertisements increases
Correct answer: Origin server response time and error rate remain normal despite elevated CDN traffic
If the origin's response time and error rate stay normal while CDN traffic spikes, mitigation is absorbing the attack without impacting legitimate users.
CDN DDoS Protection & Mitigation 2
Which DDoS attack type targets the SSL/TLS handshake process to exhaust server CPU resources?