CDN DDoS Protection & Mitigation 3

Question 1

What is a 'reflection amplification' DDoS attack?

Accepted Answer

An attack that spoofs the victim's IP to trigger large responses from third-party servers

Answer

Reflection amplification attacks spoof the victim's source IP to send small requests to open resolvers, which then flood the victim with large responses.

Question 2

Which DNS-based technique does a CDN use to redirect traffic through DDoS scrubbing infrastructure?

Accepted Answer

DNS-based traffic steering that points the domain to CDN proxy IPs

Answer

By pointing the target domain's DNS records to CDN-controlled IPs, all traffic passes through the CDN's scrubbing and mitigation layer before the origin.

Question 3

What is 'BGP blackholing' in DDoS mitigation?

Accepted Answer

Announcing a route that drops all traffic to an attacked IP prefix at upstream routers

Answer

BGP blackholing routes all traffic destined for the victim's IP to a null route, stopping the attack at the cost of also dropping legitimate traffic.

Question 4

How does 'IP reputation filtering' contribute to DDoS mitigation in a CDN?

Accepted Answer

It blocks requests from IPs known to be associated with botnets or past attacks

Answer

IP reputation databases track known malicious IPs; the CDN automatically drops traffic from these sources before further processing.

Question 5

A 'low-and-slow' DDoS attack is most effective at bypassing which type of protection?

Accepted Answer

Volumetric threshold-based rate limiting

Answer

Low-and-slow attacks send traffic just below volume thresholds, avoiding detection by systems that only trigger on high packet or request rates.

(CDN) Content Delivery Network Certification Practice Test

(CDN) Content Delivery Network Certification Practice Test

CDN DDoS Protection & Mitigation 3