Which one of these could you implement to sustain a large DDoS attack?

The correct answer is C. Connections limits and timeouts. During a large-scale DDoS attack, the goal is to keep infrastructure operational under extreme connection volume. Connection limits and timeouts (C) are the most effective tool here: they cap the number of concurrent connections and aggressively reclaim state for idle or slow…

Security Services

Question

Options

AStateful firewall
BuRPF
CConnections limits and timeouts
DAccess-lists

How the community answered

(24 responses)

A
4% (1)
B
17% (4)
C
71% (17)
D
8% (2)

Explanation

During a large-scale DDoS attack, the goal is to keep infrastructure operational under extreme connection volume. Connection limits and timeouts (C) are the most effective tool here: they cap the number of concurrent connections and aggressively reclaim state for idle or slow connections, preventing state table exhaustion. This allows the device to continue processing legitimate traffic. A stateful firewall (A) is actually a liability during DDoS because it consumes memory and CPU tracking every connection-attackers exploit this to exhaust state tables. uRPF (B) helps mitigate spoofed-source attacks but does not absorb volumetric floods. Access-lists (D) are CPU-intensive at scale and cannot be updated fast enough to keep up with dynamic DDoS traffic.

Topics

#DDoS#connection limits#timeouts#attack mitigation

Community Discussion

No community discussion yet for this question.

Full 300-320 Practice