hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A security architect is reviewing the network…
A security architect is reviewing the network architecture of a financial trading system. The system uses a time-sensitive order matching engine that must process trades with minimal latency. The architect is concerned about the risk of a DDoS attack on the matching engine. Which of the following architectural changes would best mitigate DDoS risk while preserving low latency?
⚠ Common exam trap
Many candidates assume inline security controls (IPS, reverse proxy) are always appropriate, but for ultra-low-latency environments, any inline processing—even rate limiting—adds unacceptable delay, making cloud-based scrubbing the only viable option that offloads filtering without touching the critical path.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a cloud-based DDoS scrubbing service that only forwards clean traffic to the on-premises matching engine.
A cloud-based DDoS scrubbing service (e.g., AWS Shield Advanced, Cloudflare Magic Transit) filters malicious traffic at the cloud edge before it reaches the on-premises matching engine. This preserves low latency because only clean, low-volume traffic is forwarded, and the scrubbing infrastructure is designed for high-throughput, low-latency processing without introducing inline inspection delays on the critical path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a cloud-based DDoS scrubbing service that only forwards clean traffic to the on-premises matching engine.
Why this is correct
Scrubbing services filter attacks at the cloud edge, adding minimal latency if the provider is close to the origin; they preserve low latency for clean traffic.
- ✗
Deploy an intrusion prevention system (IPS) in inline mode in front of the matching engine.
Why it's wrong here
Inline IPS adds latency and may drop legitimate traffic; not suitable for low-latency environments.
- ✗
Move the matching engine to a cloud provider with elastic scalability.
Why it's wrong here
Cloud migration may introduce network latency and does not inherently prevent DDoS; scaling can be expensive.
- ✗
Implement a reverse proxy with rate limiting and IP blacklisting.
Why it's wrong here
Rate limiting can cause false positives and adds latency; reverse proxy is not designed for high-volume DDoS mitigation.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.