Which of the following descriptions of source detection technology is incorrect?

Question

Options

• ASYN Flood attack source detection technology can verify the real source of the client
• BFor HTTP Flood attack, if the number of HTTP request messages with the same destination
• CThis technology can detect source IP addresses and discard packets from false source IP
• DSource detection technology can defend against UDP Flood attacks

• A
  3% (1)
• B
  8% (3)
• C
  16% (6)
• D
  73% (27)

Explanation

Option D is incorrect because source detection technology relies on challenge-response mechanisms to verify that a client's source IP is genuine. UDP is a connectionless, stateless protocol with no handshake, so there is no built-in way to send a challenge and confirm a real response - making source detection ineffective against UDP Flood attacks.

Why the other options are correct (and thus not the answer):

• A is correct: SYN Flood defense uses techniques like SYN proxying/SYN cookies to complete the TCP three-way handshake, which proves the client's source IP is real.
• B is correct (though the choice appears truncated): HTTP Flood source detection uses redirect or JavaScript challenges to distinguish real browsers from spoofed sources by checking follow-through behavior.
• C is correct: Identifying and dropping packets from false/spoofed IPs is precisely what source detection is designed to do - it's a core capability of the technology.

Memory tip: Think "UDP = Unverifiable by Design" - UDP has no handshake to exploit as a verification point, so source detection has nothing to "challenge." TCP and HTTP both have multi-step interactions that can be used as proof-of-life tests; UDP does not.

No community discussion yet for this question.