CDN DDoS Protection & Mitigation 5

Question 1

Which CDN DDoS protection strategy involves collaborating with upstream ISPs to filter attack traffic closer to its source?

Accepted Answer

Upstream filtering or ISP-level mitigation via BGP communities

Answer

By signaling upstream ISPs via BGP communities, attack traffic can be dropped at the ISP level before it reaches the CDN, reducing the burden on CDN infrastructure.

Question 2

What is a 'DDoS protection SLA' and what key metric does it typically guarantee?

Accepted Answer

A contractual commitment defining maximum mitigation time and availability percentage during an attack

Answer

DDoS protection SLAs typically guarantee that mitigation will be activated within a defined time and that service availability will be maintained above a stated percentage during attacks.

Question 3

How does the HTTP/2 rapid reset attack (CVE-2023-44487) differ from a standard HTTP GET flood?

Accepted Answer

It exploits HTTP/2 stream multiplexing by rapidly opening and canceling streams to overwhelm servers with minimal bandwidth

Answer

The rapid reset attack abuses HTTP/2 RST_STREAM frames to open many streams and immediately cancel them, generating massive server load with relatively little attacker bandwidth.

Question 4

What is 'always-on' DDoS mitigation, and how does it differ from 'on-demand' mitigation?

Accepted Answer

Always-on routes all traffic through scrubbing continuously, while on-demand activates mitigation only when an attack is detected

Answer

Always-on mitigation provides zero-second activation time since traffic is always inspected, whereas on-demand introduces detection lag before mitigation kicks in.

Question 5

Which type of DDoS attack specifically targets DNS infrastructure to make websites unreachable without overwhelming the web servers themselves?

Accepted Answer

DNS flood or DNS amplification attack targeting authoritative or recursive resolvers

Answer

DNS-targeted attacks overwhelm resolvers or authoritative nameservers, preventing domain resolution so users cannot reach the site even if web servers are healthy.

(CDN) Content Delivery Network Certification Practice Test

(CDN) Content Delivery Network Certification Practice Test

CDN DDoS Protection & Mitigation 5