SY0-501 · Question #523
A bank is experiencing a DoS attack against an application designed to handle 500IP-based sessions. in addition, the perimeter router can only handle 1Gbps of traffic. Which of the following should…
The correct answer is D. Use redundancy across all network devices and services. To prevent future DoS attacks against both an application and network infrastructure, implementing redundancy across all network devices and services is the most effective comprehensive solution.
Question
A bank is experiencing a DoS attack against an application designed to handle 500IP-based sessions. in addition, the perimeter router can only handle 1Gbps of traffic. Which of the following should be implemented to prevent a DoS attacks in the future?
Options
- ADeploy multiple web servers and implement a load balancer
- BIncrease the capacity of the perimeter router to 10 Gbps
- CInstall a firewall at the network to prevent all attacks
- DUse redundancy across all network devices and services
How the community answered
(44 responses)- A7% (3)
- B11% (5)
- C2% (1)
- D80% (35)
Why each option
To prevent future DoS attacks against both an application and network infrastructure, implementing redundancy across all network devices and services is the most effective comprehensive solution.
While deploying multiple web servers with a load balancer improves application scalability and distributes legitimate requests, it doesn't comprehensively address network-level DoS attacks that could still overwhelm the single perimeter router or other network infrastructure components.
Increasing the perimeter router's capacity only scales one component vertically and does not provide redundancy or address other potential bottlenecks or application-layer attacks within the network.
A firewall is a crucial security device for filtering traffic, but it cannot prevent "all attacks," especially complex DoS attacks designed to bypass standard filtering or overwhelm the firewall itself.
Redundancy involves duplicating critical network components and services, ensuring that if one component (like the router or application server) is overwhelmed or fails during a DoS attack, others can continue processing traffic. This distributed architecture significantly increases the overall capacity and availability of the system, making it more resilient to saturation and disruption caused by malicious traffic.
Concept tested: DoS Attack Resilience through Redundancy
Source: https://docs.microsoft.com/en-us/azure/security/fundamentals/ddos-best-practices
Topics
Community Discussion
No community discussion yet for this question.