2.2.5 Distributed Denial of Service (DDOS)

What is the primary goal of a Distributed Denial of Service (DDoS) attack?

In what way does a DDoS attack exploit 'legitimate connections'?

Why is blocking individual IP addresses often ineffective in mitigating a DDoS attack?

Which layer of the OSI model is targeted by an HTTP flood attack?

What is the primary purpose of a botnet in a DDoS attack?

Which type of DDoS attack involves exploiting the three-way handshake process?

In a SYN flood attack, what is the significance of spoofing the source IP address?

Which type of DDoS attack relies on amplifying traffic by exploiting DNS servers?

Why is it difficult to distinguish malicious traffic from legitimate traffic in some DDoS attacks?

What is a key characteristic of volumetric DDoS attacks?

What is the main advantage for an attacker in using DNS amplification for a DDoS attack?

What is the most common symptom experienced by legitimate users during a successful DDoS attack?

Why is it important to implement specialized DDoS mitigation techniques, rather than relying solely on traditional network security measures?

What is the role of compromised machines in a DDoS attack?

In the context of DDoS attacks, what does the term 'overload' refer to?

Which of the following is a characteristic of 'application layer' DDoS attacks?

What is the primary difference between a 'protocol attack' and a 'volumetric attack' in the context of DDoS?

Why are botnets often composed of devices whose owners are unaware of their involvement in a DDoS attack?

How does the computational imbalance between client and server contribute to the effectiveness of application layer DDoS attacks?

In a SYN flood attack, what is the state of connections left waiting for the second part of the three-way handshake?

What is the key difference between an amplification-based DDoS attack and other types of DDoS attacks, in terms of the resources required by the attacker?

What is the primary impact of a successful volumetric DDoS attack on legitimate application users?

In a DNS amplification attack, why are DNS servers targeted?

What is a key challenge in mitigating DDoS attacks that mimic legitimate traffic?

Why is it difficult to implement single IP address blocks to prevent all types of DDoS Attacks?

Which statement is most accurate regarding the owners of devices used in a botnet?

What is the role of 'spoofed IP addresses' in SYN flood and DNS amplification attacks?

Which scenario best describes an application layer DDoS attack?

What makes a 'volumetric attack' different from other DDoS attack types?

How does the architecture of a network with 'auto scaling' help in mitigating DDoS attacks?

An attacker sets up a botnet comprised of low-powered IoT devices to flood a target server with seemingly legitimate HTTP requests. The aim is to exhaust the server's resources and prevent legitimate users from accessing the service. Which type of DDoS attack is being employed?

A network administrator observes a sudden surge in network traffic consisting of small DNS requests originating from numerous unique IP addresses, all directed towards a handful of public DNS resolvers. The responses from these resolvers are significantly larger than the requests and are directed towards the organization's web servers, causing them to become unresponsive. Which type of DDoS attack is likely occurring?

An attacker leverages a botnet to send a massive number of TCP SYN packets to a target server with spoofed source IP addresses. The server responds to each SYN packet with a SYN-ACK packet, but because the source IP addresses are spoofed, the final ACK packet in the TCP handshake is never received. This leaves the server with numerous half-open connections, exhausting its resources. Which type of DDoS attack is being conducted?

A company's web application experiences a sudden and unexplainable slowdown. Upon investigation, the network security team discovers that the web servers are receiving an abnormally high volume of seemingly legitimate HTTP GET requests for resource-intensive pages, such as those involving complex database queries or image processing. These requests are originating from a large number of distinct IP addresses spread across the globe. Which type of DDoS attack is most likely in progress?

A network engineer notices an unusually high volume of inbound UDP traffic flooding their organization's network. The traffic is originating from a large number of distinct IP addresses and is directed towards a wide range of ports on the organization's servers. The network's bandwidth is being saturated, causing legitimate traffic to be dropped and resulting in widespread service disruptions. Which type of DDoS attack is most likely occurring?

An attacker manages to infiltrate a cluster of web servers running behind a load balancer. After gaining administrative access to each server, they deploy a malicious script that causes each server to repeatedly request a large file download from a single backend database server. The database server quickly becomes overwhelmed, causing database queries for legitimate user requests to time out and the entire application to become unavailable. What kind of attack is this?

A government agency is investigating a series of coordinated cyberattacks against critical infrastructure targets, including power grids, water treatment plants, and communication networks. Forensic analysis reveals the attacks involved highly customized malware designed to exploit zero-day vulnerabilities in industrial control systems (ICS) and supervisory control and data acquisition (SCADA) systems. Furthermore, the attacks were carefully timed to coincide with specific operational events and involved the coordinated use of multiple attack vectors, including DDoS attacks to mask the attackers' activities. Which type of attack is this?

A threat intelligence firm discovers a sophisticated DDoS botnet composed entirely of compromised network infrastructure devices, such as routers, switches, and firewalls, rather than end-user devices. These devices have been infected with custom firmware that allows attackers to remotely control them and launch high-volume DDoS attacks without being easily traced back to the original source. The botnet also employs advanced techniques to evade detection, such as dynamically shifting the source port and IP addresses of attack traffic. In which challenging attribute would you classify this?

An attacker uses a global network of compromised high-reputation cloud servers each with dedicated high speed internet connections to flood a banking network with HTTPS requests. The requests all appear cryptographically valid and originate from millions of different source IP addresses worldwide. The connections all correctly negotiate TLS 1.3 encryption. What technique would be most effective to identify this attack?