CEH Practice Question: Malware, Social Engineering and Network Attacks
A company wants to defend against DNS amplification attacks. Which mitigation technique would be MOST effective?
⚠ Common exam trap
EC-CEH often tests the misconception that disabling recursive queries fully prevents DNS amplification, but the trap here is that rate limiting is the most effective defense because it directly throttles the amplified response volume, whereas disabling recursion only prevents the server from being an open resolver but does not stop attacks using other resolvers or targeting the server itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing rate limiting on DNS servers
B is correct because rate limiting restricts the number of DNS responses a server sends to a single source, reducing the volume of traffic that can be generated in an amplification attack. DNS amplification exploits open recursive resolvers to send small queries that yield large responses, and rate limiting directly curbs the attacker's ability to flood the victim with amplified traffic. This technique is specifically recommended in RFC 5358 and by industry best practices for mitigating reflection/amplification DDoS attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disabling recursive queries on DNS servers
Why it's wrong here
Disabling recursive queries prevents the server from being used as a reflector, which is effective, but rate limiting is a broader mitigation. However, disabling recursion is a specific control. The question asks for the most effective among these, and rate limiting is a standard mitigation.
- ✓
Implementing rate limiting on DNS servers
Why this is correct
Rate limiting reduces the number of DNS responses to a single source, mitigating amplification.
- ✗
Deploying anycast routing
Why it's wrong here
Anycast distributes traffic across multiple servers, but does not prevent amplification.
- ✗
Using a scrubbing center
Why it's wrong here
Scrubbing centers filter malicious traffic but are not specific to DNS amplification.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.