Which of the following is a viable containment strategy for a distributed denial of service (DDoS) attack?

The correct answer is C. Redirect the attacker's traffic. In a DDoS attack, traffic volumes are too large and distributed to stop at the perimeter alone. Redirecting the attacker's traffic - for example, through traffic scrubbing services, black-hole routing, or sinkholes - neutralizes the attack without disrupting legitimate…

Submitted by suresh_in· Apr 18, 2026Information Security Incident Management

Question

Options

ADisable firewall ports exploited by the attacker.
BPower off affected servers.
CRedirect the attacker's traffic.
DBlock IP addresses used by the attacker.

How the community answered

(52 responses)

A
4% (2)
B
2% (1)
C
92% (48)
D
2% (1)

Explanation

In a DDoS attack, traffic volumes are too large and distributed to stop at the perimeter alone. Redirecting the attacker's traffic - for example, through traffic scrubbing services, black-hole routing, or sinkholes - neutralizes the attack without disrupting legitimate services. Option A (disabling firewall ports) would block legitimate traffic and cause a self-inflicted denial of service. Option B (powering off affected servers) simply completes the attacker's goal. Option D (blocking IP addresses) is largely ineffective against DDoS because attackers use massive botnets with thousands of source IPs, making IP-based blocking impractical.

Topics

#DDoS#Containment#Incident Response#Traffic Redirection

Community Discussion

No community discussion yet for this question.

Full CISM Practice