What is an effective defense against a denial-of-service attack?

Question

Options

• Adeploy a firewall to reject suspect network packets
• Bflood the web servers with ICMP echo requests to reduce attack output
• Cdisconnect the upstream ISP and reconnect affected network interfaces
• Dconfigure additional network interfaces for legitimate network traffic

• A
  7% (2)
• B
  3% (1)
• C
  80% (24)
• D
  10% (3)

Explanation

Disconnecting from the upstream ISP cuts off the attack traffic at its entry point before it can saturate your network bandwidth - then reconnecting the affected interfaces (ideally after the ISP implements upstream filtering or null-routing) allows legitimate traffic to resume. A is a common distractor because firewalls can filter some malicious packets, but during a volumetric DoS attack the upstream pipe is already saturated before traffic ever reaches your firewall, making it ineffective against the root problem. B is the opposite of a defense - adding your own ICMP flood compounds the congestion and worsens the attack impact on your own servers. D adds capacity for legitimate traffic but does nothing to reduce or stop the attack traffic itself, so the extra interfaces are just as overwhelmed as the originals.

Memory tip: Think "cut the hose, then turn it back on slowly" - the ISP connection is the hose; disconnecting it stops the flood at the source, not after it's already filled your pipes.

No community discussion yet for this question.