CAS-002 · Question #304
The Chief Executive Officer (CEO) of an Internet service provider (ISP) has decided to limit the company's contribution to worldwide Distributed Denial of Service (DDoS) attacks. Which of the…
The correct answer is C. Block traffic with a source IP not allocated to the ISP from exiting the ISP's network. E. Notify customers when services they run are involved in an attack. An ISP limits its contribution to DDoS attacks by filtering spoofed outbound traffic (BCP38) and notifying customers whose infrastructure is being used as attack participants.
Question
The Chief Executive Officer (CEO) of an Internet service provider (ISP) has decided to limit the company's contribution to worldwide Distributed Denial of Service (DDoS) attacks. Which of the following should the ISP implement? (Select TWO).
Options
- ABlock traffic from the ISP's networks destined for blacklisted IPs.
- BPrevent the ISP's customers from querying DNS servers other than those hosted by the ISP.
- CBlock traffic with a source IP not allocated to the ISP from exiting the ISP's network.
- DScan the ISP's customer networks using an up-to-date vulnerability scanner.
- ENotify customers when services they run are involved in an attack.
How the community answered
(29 responses)- A14% (4)
- B21% (6)
- C62% (18)
- D3% (1)
Why each option
An ISP limits its contribution to DDoS attacks by filtering spoofed outbound traffic (BCP38) and notifying customers whose infrastructure is being used as attack participants.
Blocking traffic destined for blacklisted IPs protects ISP customers from receiving attack traffic, but it does not prevent the ISP's own network from being used as a source of outbound DDoS traffic.
Forcing customers to use only the ISP's DNS servers is a privacy and control measure that does not reduce the ISP's contribution to DDoS attacks.
Blocking outbound traffic with source IPs not allocated to the ISP implements BCP38 egress filtering, which prevents IP address spoofing - a core technique used in amplification and reflection DDoS attacks that originate from the ISP's network.
Scanning customer networks with a vulnerability scanner exceeds the ISP's authority over customer infrastructure and does not directly mitigate the ISP's role as an attack traffic source.
Notifying customers when their services are participating in an attack allows those customers to identify and remediate compromised or misconfigured devices (such as open resolvers or botnets), directly reducing the ISP's contribution to ongoing DDoS activity.
Concept tested: ISP egress filtering and BCP38 to reduce DDoS contribution
Source: https://www.rfc-editor.org/rfc/rfc2827
Topics
Community Discussion
No community discussion yet for this question.