The figure shows the defense principle of HTTP Flood. Which source detection technology is shown in the figure?

Question

Exhibits

Options

• A302 redirect mode
• BBasic mode
• CURI monitoring
• DEnhanced mode

• A
  11% (2)
• C
  6% (1)
• D
  83% (15)

Explanation

Enhanced mode (D) is correct because it represents the most sophisticated HTTP Flood source detection technique - typically involving multi-step client challenges such as JavaScript execution or cookie verification. In diagrams, it appears as a multi-exchange flow where the defense device issues a challenge, the client must respond correctly (proving it runs a real browser stack), and only then is traffic permitted. This distinguishes legitimate users from flood bots that lack a JavaScript engine.

Why the distractors are wrong:

• A (302 redirect mode) only issues a simple HTTP 302 redirect; legitimate browsers follow it, but the mechanism is a single-step check - too simple to match a multi-stage detection diagram.
• B (Basic mode) applies threshold-based rate limiting with no active client challenge - it's purely reactive, not a source verification flow.
• C (URI monitoring) watches specific endpoints for abnormal request rates; it identifies which URLs are under attack, not who the attacker is.

Memory tip: Think of the modes on a spectrum - Basic (count requests) → URI monitoring (watch endpoints) → 302 redirect (one-step challenge) → Enhanced (multi-step challenge). A figure showing back-and-forth verification exchanges between the defense device and the source always maps to Enhanced - the only mode that demands the client prove it's a real browser before traffic is allowed through.

No community discussion yet for this question.