Which mitigation technique does a web application firewall use to protect a web server against DDoS attacks?

Question

Options

• ASource-specific ACL
• BStandard ACL
• CPacket filtering
• DRate-based rules

• A
  5% (2)
• B
  2% (1)
• C
  10% (4)
• D
  83% (34)

Explanation

Rate-based rules (D) are the WAF mechanism specifically designed for DDoS defense: they monitor the rate of incoming requests and automatically block or throttle traffic from sources exceeding defined thresholds, which directly counters the volume-flooding nature of DDoS attacks.

Why the others are wrong:

• A (Source-specific ACL) blocks or permits traffic based on specific IP addresses - useful for blocklisting known bad actors, but ineffective against distributed attacks using thousands of IPs.
• B (Standard ACL) filters based on source IP only and operates at the network layer, not the application layer where WAFs live; it has no concept of request rates or HTTP behavior.
• C (Packet filtering) inspects individual packets against rules (IP, port, protocol) but doesn't track request volume over time, so it can't detect or react to a flood pattern.

Memory tip: Think of rate-based rules as a "speed limit" - a WAF doesn't care who you are, it cares how fast you're going. DDoS = too much traffic too fast → rate limiter kicks in. The word "rate" in "DDoS rate flood" maps directly to "rate-based rules."

No community discussion yet for this question.