nerdexam
Cisco

350-501 · Question #148

Refer to the exhibit. Which type of DDoS attack will be mitigated by this configuration?

The correct answer is B. smurf attack. Assuming the exhibit shows the 'no ip directed-broadcast' command, this configuration is specifically designed to mitigate a smurf attack by preventing the router from forwarding IP directed broadcasts.

Networking

Question

Refer to the exhibit. Which type of DDoS attack will be mitigated by this configuration?

Options

  • ASYN flood
  • Bsmurf attack
  • CSIP INVITE flood attacks
  • Dteardrop attack

How the community answered

(57 responses)
  • A
    2% (1)
  • B
    89% (51)
  • C
    2% (1)
  • D
    7% (4)

Why each option

Assuming the exhibit shows the 'no ip directed-broadcast' command, this configuration is specifically designed to mitigate a smurf attack by preventing the router from forwarding IP directed broadcasts.

ASYN flood

SYN flood attacks target TCP connection setup and are typically mitigated by SYN cookies or TCP intercept mechanisms, not by disabling IP directed broadcasts.

Bsmurf attackCorrect

A smurf attack relies on sending ICMP requests to an IP broadcast address with a spoofed source IP of the victim. Disabling IP directed broadcasts on router interfaces prevents the router from forwarding such broadcasts, thus stopping the amplification effect that floods the victim.

CSIP INVITE flood attacks

SIP INVITE flood attacks target VoIP infrastructure and are mitigated by specific SIP-aware firewalls or rate-limiting features, unrelated to IP directed broadcasts.

Dteardrop attack

Teardrop attacks involve malformed fragmented IP packets and are mitigated by proper IP reassembly logic in operating systems or firewalls, not by broadcast control.

Concept tested: DDoS Smurf Attack Mitigation

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/dpa/sec-dpa-cg-ios-xe/sec-dpa-cg-ios-xe_chapter_01.html#d2720e178a1670

Topics

#DDoS#Smurf Attack#Network Security#IP Directed Broadcast

Community Discussion

No community discussion yet for this question.

Full 350-501 Practice