CDN DDoS Protection & Mitigation 4 — Questions and Answers
Question 1: What is the primary advantage of using a CDN's distributed network for DDoS mitigation over a single on-premise scrubbing appliance?
- The CDN's aggregate bandwidth across all PoPs far exceeds what any single appliance can absorb (Correct answer)
- CDNs provide faster SSL termination than on-premise hardware
- CDNs eliminate the need for firewall rules entirely
- On-premise appliances cannot inspect HTTP headers
Correct answer: The CDN's aggregate bandwidth across all PoPs far exceeds what any single appliance can absorb
A global CDN may have terabits of aggregate capacity spread across hundreds of PoPs, making it far better suited to absorb massive volumetric DDoS attacks than any single device.
Question 2: Which Layer 7 DDoS attack sends incomplete HTTP POST requests to keep server connections open indefinitely?
- RUDY (R-U-Dead-Yet) slow POST attack (Correct answer)
- HTTP GET flood
- SSL renegotiation attack
- Cache poisoning flood
Correct answer: RUDY (R-U-Dead-Yet) slow POST attack
RUDY sends HTTP POST requests with a very large declared content length but drips data byte-by-byte, exhausting server connection pools without triggering high-volume detection.
Question 3: How does 'connection rate limiting' at a CDN edge node differ from 'request rate limiting'?
- Connection rate limiting restricts new TCP connections per IP, while request rate limiting limits HTTP requests per IP over time (Correct answer)
- Connection rate limiting applies only to UDP, while request rate limiting applies to TCP
- Connection rate limiting is set at the origin, while request rate limiting is set at the CDN edge
- Connection rate limiting blocks all connections above a threshold, while request rate limiting queues excess requests
Correct answer: Connection rate limiting restricts new TCP connections per IP, while request rate limiting limits HTTP requests per IP over time
Connection rate limiting targets the TCP handshake layer to stop SYN floods, while request rate limiting operates at the HTTP layer to stop application-level floods.
Question 4: What is 'geographic-based blocking' and when would a CDN operator use it during a DDoS attack?
- Dropping all traffic from specific countries or regions identified as the primary attack source (Correct answer)
- Routing traffic to geographically closer PoPs to reduce latency during attacks
- Blocking CDN PoPs in certain regions from serving content
- Restricting geographic spread of BGP announcements
Correct answer: Dropping all traffic from specific countries or regions identified as the primary attack source
When attack traffic originates overwhelmingly from specific regions, blocking those geographies at the CDN edge can significantly reduce attack volume at the cost of blocking legitimate users from those areas.
Question 5: Which protocol characteristic makes UDP more susceptible to amplification DDoS attacks than TCP?
- UDP is connectionless and does not require a handshake, making source IP spoofing trivial (Correct answer)
- UDP packets are larger than TCP packets by default
- UDP uses more server CPU than TCP for processing
- UDP does not support rate limiting at the network layer
Correct answer: UDP is connectionless and does not require a handshake, making source IP spoofing trivial
Because UDP has no connection establishment, attackers can forge source IPs freely, enabling them to redirect amplified responses from reflectors to any victim.
Question 6: A CDN implements 'token bucket' rate limiting. What happens when a client's token bucket is empty?
- Subsequent requests are dropped or queued until the bucket refills at a configured rate (Correct answer)
- The CDN serves cached content only and blocks dynamic requests
- The client's IP is permanently blacklisted
- The CDN reroutes the client through a CAPTCHA challenge page
Correct answer: Subsequent requests are dropped or queued until the bucket refills at a configured rate
In the token bucket algorithm, each request consumes a token; when the bucket is empty, excess requests are dropped or queued until tokens regenerate at the refill rate.
Question 7: What is 'SYN cookie' protection and how does it help a CDN mitigate SYN flood attacks?
- The server encodes connection state in the SYN-ACK sequence number, eliminating the need to store half-open connections (Correct answer)
- The CDN sets a cookie in the browser to authenticate subsequent SYN packets
- SYN cookies encrypt all TCP headers to prevent spoofing
- The CDN drops all SYN packets during an attack until the flood subsides
Correct answer: The server encodes connection state in the SYN-ACK sequence number, eliminating the need to store half-open connections
SYN cookies encode session state cryptographically in the sequence number, so the server does not allocate memory for half-open connections until the client completes the handshake.
CDN DDoS Protection & Mitigation 4
What is the primary advantage of using a CDN's distributed network for DDoS mitigation over a single on-premise scrubbing appliance?