Which of the following DDoS attack types can be prevented by current limiting technology?

Question

Options

• ADNS
• BHTTP
• CICMP
• DSYN

• A
  4% (2)
• B
  10% (5)
• C
  81% (39)
• D
  4% (2)

Explanation

ICMP flood attacks are uniquely well-suited to rate limiting defenses because ICMP (ping) traffic is non-essential for most applications - a firewall or router can simply cap the number of ICMP packets per second with no meaningful impact on legitimate services, effectively neutralizing a volumetric ICMP flood.

Why the distractors are wrong:

• A. DNS - DNS amplification attacks exploit open resolvers to reflect large responses toward victims; rate limiting alone is insufficient because the attacker uses spoofed source IPs and the volume comes from third-party servers, not the attacker directly.
• B. HTTP - HTTP floods operate at Layer 7 using seemingly legitimate requests; they require application-level defenses (WAFs, CAPTCHA, behavioral analysis) because the individual requests look valid and simple rate limiting can block real users.
• D. SYN - SYN floods exhaust the TCP connection table by leaving half-open connections; the standard fix is SYN cookies, which avoid maintaining state for unconfirmed handshakes - rate limiting doesn't address the state exhaustion mechanism.

Memory tip: Think "ICMP = I Can Mostly Cut-off." ICMP is the only one of the four where blocking or throttling the protocol type itself is a safe, effective mitigation - the other three involve protocols critical to web services, requiring smarter, protocol-aware defenses.

No community discussion yet for this question.