What is an effective mitigation for an HTTP flood attack?

The correct answer is C. Interrupt connections using CAPTCHA. HTTP floods are difficult to mitigate through analysis of sessions or by statistical criteria because HTTP flood requests are designed to appear as normal traffic. Floods originate from bots that are running scripts that make normal-looking GET and POST requests in normal…

Web Application Attacks & Post-Exploitation

Question

Options

AInspect connections using a reverse proxy and stall those showing repetitive patterns
BDrop connections using the most bandwidth
CInterrupt connections using CAPTCHA
DAnalyze requests and drop those using multiple GETs

How the community answered

(34 responses)

A
12% (4)
B
6% (2)
C
79% (27)
D
3% (1)

Explanation

HTTP floods are difficult to mitigate through analysis of sessions or by statistical criteria because HTTP flood requests are designed to appear as normal traffic. Floods originate from bots that are running scripts that make normal-looking GET and POST requests in normal traffic volumes and with expected Useragent values. It is the collective bandwidth of all bots rather than high traffic from a single source that creates the DoS. Because they are bots that are running a script, they are unable to react to situations that require human interactions, like CAPTCHAs. Another characteristic of website traffic is its repetitiveness as users traverse pages in the site, which renders this ineffective as a tactic for preventing floods.

Topics

#HTTP flood#application layer DDoS#CAPTCHA mitigation#rate limiting

Community Discussion

No community discussion yet for this question.

Full GCIH Practice