352-001 · Question #501
For the following items, which one is the weakness of rate limiting as a response to a DoS attack?
The correct answer is B. Rate limiting does not detect attacks. Rate limiting throttles traffic volume but lacks the intelligence to identify or alert on an active DoS attack, meaning the attack goes undetected.
Question
For the following items, which one is the weakness of rate limiting as a response to a DoS attack?
Options
- ARate limiting does not drop enough packets.
- BRate limiting does not detect attacks.
- CRate limiting only works on inbound traffic.
- DRate limiting is too processor-intensive.
How the community answered
(29 responses)- A3% (1)
- B86% (25)
- C10% (3)
Why each option
Rate limiting throttles traffic volume but lacks the intelligence to identify or alert on an active DoS attack, meaning the attack goes undetected.
Rate limiting does drop packets once a configured threshold is exceeded, so claiming it does not drop enough packets misrepresents its actual behavior.
Rate limiting operates by capping the number of packets or connections permitted within a time window, but it has no mechanism to distinguish malicious flood traffic from legitimate high-volume bursts. Because it lacks attack detection or classification capability, it may silently drop legitimate traffic while never flagging or logging the ongoing DoS event, leaving operators unaware an attack is in progress.
Rate limiting policies can be applied to both inbound and outbound traffic directions and are not architecturally restricted to inbound only.
Rate limiting is a lightweight policer function implemented efficiently in hardware or software and is not considered processor-intensive compared to stateful inspection or DPI.
Concept tested: Limitations of rate limiting as DoS mitigation
Source: https://www.cisco.com/c/en/us/about/security-center/ddos-best-practices.html
Topics
Community Discussion
No community discussion yet for this question.