Which types of algorithm does a web application firewall use for zero-day DDoS protection?

Question

Options

• AReactive and heuristic-based
• BStochastic and event-based
• CCorrelative and feedback-based
• DAdaptive and behavioral-based

• A
  8% (2)
• B
  4% (1)
• C
  12% (3)
• D
  77% (20)

Explanation

Adaptive and behavioral-based algorithms are correct because zero-day DDoS attacks are, by definition, unknown threats with no pre-existing signatures - so a WAF must adapt to evolving traffic patterns and establish baselines of normal behavior to detect anomalies in real time without relying on known attack fingerprints.

Why the distractors are wrong:

• A (Reactive and heuristic-based): "Reactive" implies responding after an attack is recognized, making it unsuitable for unknown zero-day threats; heuristic rules are also signature-adjacent and struggle with novel attack vectors.
• B (Stochastic and event-based): These terms describe probability modeling and trigger-based responses - neither is a standard WAF classification, and event-based systems still depend on known conditions to fire.
• C (Correlative and feedback-based): Correlation is used in SIEMs for log analysis across systems, not in WAFs for real-time DDoS mitigation; this conflates two different security tool categories.

Memory tip: Think "Adapt to Behavior" - zero-day = unknown, so the WAF must watch how traffic behaves over time rather than match it against a known threat list. If the algorithm can't learn on its own, it can't stop what it's never seen.

No community discussion yet for this question.