CDN DDoS Protection & Mitigation 2

Question 1

Which DDoS attack type targets the SSL/TLS handshake process to exhaust server CPU resources?

Accepted Answer

SSL flood

Answer

SSL floods force repeated TLS handshakes, consuming significant CPU on the server side since cryptographic operations are computationally expensive.

Question 2

What is a 'scrubbing center' in the context of CDN-based DDoS mitigation?

Accepted Answer

A centralized facility that filters malicious traffic before forwarding clean traffic to the origin

Answer

Scrubbing centers are specialized facilities that absorb, analyze, and clean attack traffic, forwarding only legitimate requests to the origin server.

Question 3

During a volumetric DDoS attack, which CDN mechanism helps absorb traffic by distributing it across many PoPs?

Accepted Answer

Anycast routing

Answer

Anycast routing directs incoming traffic to the nearest PoP, spreading volumetric attack load across the CDN's global network capacity.

Question 4

What distinguishes a protocol attack from a volumetric DDoS attack?

Accepted Answer

Protocol attacks exploit weaknesses in Layer 3/4 protocols rather than overwhelming bandwidth

Answer

Protocol attacks exploit flaws in TCP/IP stack behavior (e.g., SYN floods) to exhaust connection tables, whereas volumetric attacks simply flood bandwidth.

Question 5

A CDN detects 10,000 requests per second from a single IP to one endpoint. What mitigation action is most appropriate?

Accepted Answer

Rate limit and block that IP at the edge

Answer

Rate limiting and blocking the offending IP at the CDN edge prevents the attack traffic from ever reaching the origin server.

(CDN) Content Delivery Network Certification Practice Test

(CDN) Content Delivery Network Certification Practice Test

CDN DDoS Protection & Mitigation 2