PCNSE · Question #238
Which DoS protection mechanism detects and prevents session exhaustion attacks?
The correct answer is C. Resource Protection. Resource Protection (C) is specifically designed to prevent session table exhaustion, which occurs when an attacker (or misconfigured device) opens so many concurrent sessions that the firewall runs out of session resources for legitimate traffic. It enforces a maximum…
Question
Which DoS protection mechanism detects and prevents session exhaustion attacks?
Exhibit
Options
- APacket Based Attack Protection
- BFlood Protection
- CResource Protection
- DTCP Port Scan Protection
How the community answered
(46 responses)- A9% (4)
- B2% (1)
- C87% (40)
- D2% (1)
Explanation
Resource Protection (C) is specifically designed to prevent session table exhaustion, which occurs when an attacker (or misconfigured device) opens so many concurrent sessions that the firewall runs out of session resources for legitimate traffic. It enforces a maximum concurrent session limit per source or destination. Flood Protection (B) addresses volumetric attacks like SYN, UDP, and ICMP floods at the packet rate level. Packet Based Attack Protection (A) handles malformed or anomalous packets. TCP Port Scan Protection (D) is a reconnaissance-detection mechanism, not a session exhaustion defense.
Topics
Community Discussion
No community discussion yet for this question.