Anti-DDoS's session inspection mechanism can prevent multiple-select which of the following attacks? (Multiple choice)

Question

Options

• ATCP connection exhaustion attack
• BACK
• CTCP abnormal session attack
• DUDP

• A
  75% (21)
• D
  25% (7)

Explanation

Anti-DDoS session inspection works by tracking and validating TCP connection states - it monitors the full lifecycle of a session (SYN, SYN-ACK, ACK, data, FIN) to detect anomalies.

Why A, B, and C are correct:

• (A) TCP connection exhaustion: Session inspection detects floods of half-open or fake connections (e.g., SYN floods) that aim to exhaust the server's connection table, and drops them before resources are consumed.
• (B) ACK flood: Inspection validates that incoming ACK packets correspond to a legitimately established session; orphaned ACKs with no matching session record are identified and discarded.
• (C) TCP abnormal session attack: This is the core use case - session inspection flags packets with illegal flag combinations, out-of-sequence numbers, or other state violations that don't match a valid TCP session lifecycle.

Why D is wrong: UDP is a connectionless protocol - it has no handshake, no session state, and no connection lifecycle to inspect. Session inspection is fundamentally a stateful TCP mechanism and is ineffective against UDP-based floods, which require different countermeasures (e.g., rate limiting, source validation).

Memory tip: "Session inspection = TCP state tracking." If there's no session to track (UDP), there's nothing to inspect - only TCP-based attacks (exhaustion, anomalous ACKs, malformed sessions) fall within its scope.

No community discussion yet for this question.