A company receives an email threat informing of an Imminent Distributed Denial of Service (DDoS) attack targeting its web application, unless ransom is paid. Which of the following techniques BEST…

Load balancers distribute traffic across servers to improve availability and performance, but they do not filter or reduce the volume of malicious DDoS traffic - they would simply spread the attack load across multiple targets, still overwhelming resources.

WAFs are designed to filter application-layer (Layer 7) attacks such as SQL injection and XSS, but they are typically insufficient against large volumetric DDoS attacks (Layers 3/4) that can saturate network bandwidth before traffic even reaches the WAF.

Reverse proxies can validate connections and provide some protection against certain application-layer attacks, but they still sit within or near the target network and cannot absorb the massive bandwidth of a volumetric DDoS attack that would saturate upstream links.

ISPs can implement upstream traffic scrubbing, blackhole routing (RTBH), and rate limiting at the network edge before attack traffic ever reaches the target organization's infrastructure. This is the most effective DDoS mitigation approach because ISPs have the bandwidth capacity and peering relationships to absorb and filter volumetric attacks at a scale that on-premises solutions cannot match. Many ISPs offer dedicated DDoS mitigation services that can redirect traffic through scrubbing centers, removing malicious packets while allowing legitimate traffic to pass.