352-001 · Question #507
Which security benefit can be provided by IPv4 anycast for a service such as DNS?
The correct answer is D. Improved availability of services during DoS attacks. IPv4 anycast allows multiple geographically distributed servers to share a single IP address, so a DoS attack targeting that address is spread across many nodes rather than overwhelming one. This distributes attack traffic and keeps the service available.
Question
Which security benefit can be provided by IPv4 anycast for a service such as DNS?
Options
- AMitigation of attacks
- BRobust detection capabilities
- CMultiple paths to the service
- DImproved availability of services during DoS attacks
How the community answered
(22 responses)- A5% (1)
- B5% (1)
- C9% (2)
- D82% (18)
Why each option
IPv4 anycast allows multiple geographically distributed servers to share a single IP address, so a DoS attack targeting that address is spread across many nodes rather than overwhelming one. This distributes attack traffic and keeps the service available.
Anycast does not mitigate or stop attack traffic; it distributes it, meaning the attacks still reach servers - just different ones, so mitigation is not the accurate security benefit.
Anycast is a routing and addressing technique and provides no detection or inspection capabilities for identifying malicious traffic.
Having multiple paths to a service describes routing redundancy or ECMP behavior, which is a general availability feature rather than the specific security benefit anycast provides against DoS attacks.
With anycast, routing protocols direct each attacking source to its topologically nearest server instance, effectively distributing the volumetric load of a DoS attack across multiple nodes and preventing any single server from being overwhelmed, thus improving service availability during an attack.
Concept tested: IPv4 anycast DNS resilience against DoS attacks
Source: https://www.cisco.com/c/en/us/about/security-center/guide-ddos-defense.html
Topics
Community Discussion
No community discussion yet for this question.