nerdexam
Cisco

352-001 · Question #507

Which security benefit can be provided by IPv4 anycast for a service such as DNS?

The correct answer is D. Improved availability of services during DoS attacks. IPv4 anycast allows multiple geographically distributed servers to share a single IP address, so a DoS attack targeting that address is spread across many nodes rather than overwhelming one. This distributes attack traffic and keeps the service available.

Designing Security

Question

Which security benefit can be provided by IPv4 anycast for a service such as DNS?

Options

  • AMitigation of attacks
  • BRobust detection capabilities
  • CMultiple paths to the service
  • DImproved availability of services during DoS attacks

How the community answered

(22 responses)
  • A
    5% (1)
  • B
    5% (1)
  • C
    9% (2)
  • D
    82% (18)

Why each option

IPv4 anycast allows multiple geographically distributed servers to share a single IP address, so a DoS attack targeting that address is spread across many nodes rather than overwhelming one. This distributes attack traffic and keeps the service available.

AMitigation of attacks

Anycast does not mitigate or stop attack traffic; it distributes it, meaning the attacks still reach servers - just different ones, so mitigation is not the accurate security benefit.

BRobust detection capabilities

Anycast is a routing and addressing technique and provides no detection or inspection capabilities for identifying malicious traffic.

CMultiple paths to the service

Having multiple paths to a service describes routing redundancy or ECMP behavior, which is a general availability feature rather than the specific security benefit anycast provides against DoS attacks.

DImproved availability of services during DoS attacksCorrect

With anycast, routing protocols direct each attacking source to its topologically nearest server instance, effectively distributing the volumetric load of a DoS attack across multiple nodes and preventing any single server from being overwhelmed, thus improving service availability during an attack.

Concept tested: IPv4 anycast DNS resilience against DoS attacks

Source: https://www.cisco.com/c/en/us/about/security-center/guide-ddos-defense.html

Topics

#anycast#DNS#DoS mitigation#service availability

Community Discussion

No community discussion yet for this question.

Full 352-001 Practice