CAS-002 · Question #763
A web services company is planning a one-time high-profile event to be hosted on the corporate website. An outage, due to an attack, would be publicly embarrassing, so Joe, the Chief Executive…
The correct answer is C. Contract and configure scrubbing services with third-party DDoS mitigation providers. For a high-profile public event, the best protection against DDoS attacks is contracting with a third-party scrubbing service that can absorb and filter malicious traffic before it reaches the company's infrastructure.
Question
A web services company is planning a one-time high-profile event to be hosted on the corporate website. An outage, due to an attack, would be publicly embarrassing, so Joe, the Chief Executive Officer (CEO), has requested that his security engineers put temporary preventive controls in place. Which of the following would MOST appropriately address Joe's concerns?
Options
- AEnsure web services hosting the event use TCP cookies and deny_hosts.
- BConfigure an intrusion prevention system that blocks IPs after detecting too many incomplete
- CContract and configure scrubbing services with third-party DDoS mitigation providers.
- DPurchase additional bandwidth from the company's Internet service provider.
How the community answered
(18 responses)- A6% (1)
- C83% (15)
- D11% (2)
Why each option
For a high-profile public event, the best protection against DDoS attacks is contracting with a third-party scrubbing service that can absorb and filter malicious traffic before it reaches the company's infrastructure.
TCP cookies and deny_hosts are host-level mitigations that provide minimal protection against a coordinated, large-volume DDoS attack targeting the web layer.
An IPS blocking IPs after incomplete connections can help with SYN flood variants but is reactive and will not scale against a distributed botnet generating millions of connections from diverse IP ranges.
Third-party DDoS scrubbing services operate upstream of the target network, intercepting and filtering volumetric attack traffic before it reaches the hosting environment. These providers have massive bandwidth capacity and specialized hardware designed specifically to absorb large-scale DDoS floods. For a one-time, high-visibility event with a tight preparation window, this is the most comprehensive and immediately deployable preventive control available.
Purchasing additional bandwidth delays saturation but does not block or filter attack traffic, meaning the attack simply requires a larger volume to succeed.
Concept tested: Third-party DDoS scrubbing and mitigation services
Source: https://www.cisa.gov/topics/cyber-threats-and-advisories/threats/distributed-denial-of-service-ddos-attacks
Topics
Community Discussion
No community discussion yet for this question.