CDN DDoS Protection & Mitigation 3 — Questions and Answers
Question 1: What is a 'reflection amplification' DDoS attack?
- An attack that spoofs the victim's IP to trigger large responses from third-party servers (Correct answer)
- An attack that mirrors traffic through multiple CDN PoPs
- An attack that reflects HTTP headers back to confuse origin logic
- An attack using mirrored botnets in two geographic regions
Correct answer: An attack that spoofs the victim's IP to trigger large responses from third-party servers
Reflection amplification attacks spoof the victim's source IP to send small requests to open resolvers, which then flood the victim with large responses.
Question 2: Which DNS-based technique does a CDN use to redirect traffic through DDoS scrubbing infrastructure?
- DNS-based traffic steering that points the domain to CDN proxy IPs (Correct answer)
- DNSSEC validation at the edge
- DNS TTL extension to cache attack patterns
- Reverse DNS lookups to verify attacker identities
Correct answer: DNS-based traffic steering that points the domain to CDN proxy IPs
By pointing the target domain's DNS records to CDN-controlled IPs, all traffic passes through the CDN's scrubbing and mitigation layer before the origin.
Question 3: What is 'BGP blackholing' in DDoS mitigation?
- Announcing a route that drops all traffic to an attacked IP prefix at upstream routers (Correct answer)
- A technique to hide CDN PoP locations from attackers
- Blocking BGP advertisements from malicious ASNs
- Rerouting DDoS traffic to a honeypot via BGP communities
Correct answer: Announcing a route that drops all traffic to an attacked IP prefix at upstream routers
BGP blackholing routes all traffic destined for the victim's IP to a null route, stopping the attack at the cost of also dropping legitimate traffic.
Question 4: How does 'IP reputation filtering' contribute to DDoS mitigation in a CDN?
- It blocks requests from IPs known to be associated with botnets or past attacks (Correct answer)
- It assigns reputation scores to cached content for prioritization
- It filters out IPs with poor TLS certificate reputations
- It limits connections based on geographic IP reputation indexes
Correct answer: It blocks requests from IPs known to be associated with botnets or past attacks
IP reputation databases track known malicious IPs; the CDN automatically drops traffic from these sources before further processing.
Question 5: A 'low-and-slow' DDoS attack is most effective at bypassing which type of protection?
- Volumetric threshold-based rate limiting (Correct answer)
- Application-layer WAF rules
- IP reputation blocking
- TCP SYN cookie validation
Correct answer: Volumetric threshold-based rate limiting
Low-and-slow attacks send traffic just below volume thresholds, avoiding detection by systems that only trigger on high packet or request rates.
Question 6: Which CDN feature specifically helps mitigate NTP amplification attacks?
- Blocking UDP traffic on port 123 at the edge or rate-limiting NTP responses (Correct answer)
- Enabling HTTP/2 for all connections
- Increasing TTL on cached NTP records
- Deploying DNSSEC on the CDN zone
Correct answer: Blocking UDP traffic on port 123 at the edge or rate-limiting NTP responses
NTP amplification uses UDP port 123; blocking or rate-limiting this port at CDN edge nodes prevents the amplified traffic from reaching the origin.
Question 7: What role does 'traffic baselining' play in automated DDoS detection on a CDN?
- It establishes normal traffic patterns so anomalies can trigger mitigation automatically (Correct answer)
- It sets maximum cache storage thresholds across PoPs
- It measures baseline latency to optimize routing decisions
- It defines SLA benchmarks for CDN uptime guarantees
Correct answer: It establishes normal traffic patterns so anomalies can trigger mitigation automatically
By learning what normal traffic looks like, a CDN can detect statistical deviations that indicate an attack and engage mitigation without manual intervention.
CDN DDoS Protection & Mitigation 3
What is a 'reflection amplification' DDoS attack?