CDN DDoS Protection & Mitigation 5 — Questions and Answers
Question 1: Which CDN DDoS protection strategy involves collaborating with upstream ISPs to filter attack traffic closer to its source?
- Upstream filtering or ISP-level mitigation via BGP communities (Correct answer)
- Origin shielding with multiple redundant servers
- Edge caching of all dynamic content during attacks
- Deploying WAF rules across all PoPs simultaneously
Correct answer: Upstream filtering or ISP-level mitigation via BGP communities
By signaling upstream ISPs via BGP communities, attack traffic can be dropped at the ISP level before it reaches the CDN, reducing the burden on CDN infrastructure.
Question 2: What is a 'DDoS protection SLA' and what key metric does it typically guarantee?
- A contractual commitment defining maximum mitigation time and availability percentage during an attack (Correct answer)
- A service agreement specifying maximum CDN cache hit ratios
- A guarantee of zero packet loss during all traffic conditions
- A commitment to upgrade scrubbing capacity within 24 hours of an attack
Correct answer: A contractual commitment defining maximum mitigation time and availability percentage during an attack
DDoS protection SLAs typically guarantee that mitigation will be activated within a defined time and that service availability will be maintained above a stated percentage during attacks.
Question 3: How does the HTTP/2 rapid reset attack (CVE-2023-44487) differ from a standard HTTP GET flood?
- It exploits HTTP/2 stream multiplexing by rapidly opening and canceling streams to overwhelm servers with minimal bandwidth (Correct answer)
- It resets TCP connections faster than standard HTTP/1.1 floods
- It targets HTTP/2 header compression to cause memory exhaustion
- It uses HTTP/2 server push to amplify responses back to the attacker
Correct answer: It exploits HTTP/2 stream multiplexing by rapidly opening and canceling streams to overwhelm servers with minimal bandwidth
The rapid reset attack abuses HTTP/2 RST_STREAM frames to open many streams and immediately cancel them, generating massive server load with relatively little attacker bandwidth.
Question 4: What is 'always-on' DDoS mitigation, and how does it differ from 'on-demand' mitigation?
- Always-on routes all traffic through scrubbing continuously, while on-demand activates mitigation only when an attack is detected (Correct answer)
- Always-on uses more PoPs than on-demand during normal traffic
- Always-on mitigation requires manual activation, while on-demand is fully automated
- Always-on blocks all non-whitelisted IPs, while on-demand uses rate limiting only
Correct answer: Always-on routes all traffic through scrubbing continuously, while on-demand activates mitigation only when an attack is detected
Always-on mitigation provides zero-second activation time since traffic is always inspected, whereas on-demand introduces detection lag before mitigation kicks in.
Question 5: Which type of DDoS attack specifically targets DNS infrastructure to make websites unreachable without overwhelming the web servers themselves?
- DNS flood or DNS amplification attack targeting authoritative or recursive resolvers (Correct answer)
- HTTP GET flood targeting web server endpoints
- SSL exhaustion attack targeting CDN edge nodes
- BGP hijacking redirecting DNS traffic to attacker-controlled servers
Correct answer: DNS flood or DNS amplification attack targeting authoritative or recursive resolvers
DNS-targeted attacks overwhelm resolvers or authoritative nameservers, preventing domain resolution so users cannot reach the site even if web servers are healthy.
Question 6: What mitigation technique does a CDN use to handle 'cache-busting' DDoS attacks that force cache misses on every request?
- Request coalescing and query string normalization to reduce origin load (Correct answer)
- Disabling query string support entirely during attacks
- Increasing CDN cache TTL to prevent expiration during floods
- Blocking all requests containing query strings at the edge
Correct answer: Request coalescing and query string normalization to reduce origin load
Request coalescing ensures only one origin request is made for concurrent cache misses, while query string normalization prevents trivial cache-busting via parameter variations.
Question 7: In a post-attack DDoS incident review, which log data is most critical for understanding the attack vector?
- Edge access logs showing request patterns, source IPs, user agents, and HTTP methods during the attack window (Correct answer)
- Origin server CPU and memory utilization graphs
- CDN billing reports showing bandwidth spikes
- DNS TTL change history during the attack period
Correct answer: Edge access logs showing request patterns, source IPs, user agents, and HTTP methods during the attack window
Edge access logs capture detailed traffic characteristics needed to identify attack signatures, source distribution, targeted endpoints, and the specific attack type.
CDN DDoS Protection & Mitigation 5
Which CDN DDoS protection strategy involves collaborating with upstream ISPs to filter attack traffic closer to its source?