CEH Practice Question: Malware, Social Engineering and Network Attacks
A security engineer is configuring DDoS protection for a web server. The goal is to mitigate a Slowloris attack. Which mitigation technique is MOST effective?
⚠ Common exam trap
Watch out — candidates often confuse Slowloris with a SYN flood and choose SYN cookies (Option D), but Slowloris operates at the application layer after the TCP handshake completes, so SYN cookies are ineffective.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement rate limiting and connection timeout
Slowloris works by opening many HTTP connections and keeping them alive by sending partial requests, never completing them, which exhausts the server's connection pool. Rate limiting restricts the number of connections from a single IP, and connection timeouts force idle connections to close, directly countering Slowloris's behavior. This combination prevents the attacker from holding connections open indefinitely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use anycast routing
Why it's wrong here
Anycast routing distributes incoming network traffic across multiple geographically dispersed servers, primarily enhancing availability and reducing latency for users. However, it does not specifically address application-layer attacks like Slowloris. While anycast might spread the initial connection load, it fails to mitigate the core issue of a single server's connection pool being exhausted by partial, slow HTTP requests, as the attack vector targets the application layer on individual server instances.
- ✓
Implement rate limiting and connection timeout
Why this is correct
Slowloris attacks aim to exhaust server resources by maintaining numerous open, incomplete HTTP connections. Implementing a strict connection timeout for idle or slow-sending connections will effectively terminate these malicious sessions before they can consume all available server sockets indefinitely. Additionally, rate limiting the number of new connections or requests from a single source IP can prevent an attacker from establishing a sufficient volume of connections to overwhelm the server's capacity, thus mitigating the attack.
- ✗
Increase the maximum number of simultaneous connections
Why it's wrong here
Increasing the maximum number of simultaneous connections would exacerbate a Slowloris attack rather than mitigate it. Slowloris specifically exploits the server's ability to handle a finite number of concurrent connections by holding them open indefinitely with partial requests. A higher connection limit simply provides more "slots" for the attacker to fill, consuming even more server memory and CPU resources, thereby making the server more vulnerable to complete resource exhaustion and denial of service.
- ✗
Enable SYN cookies
Why it's wrong here
SYN cookies are a defense mechanism primarily designed to protect against SYN flood attacks, which target the TCP handshake process by overwhelming the server's SYN queue. They work by deferring the allocation of server resources until a full TCP handshake is completed. However, Slowloris operates at the application layer (HTTP) after the TCP connection is established, keeping connections open with incomplete requests. Therefore, SYN cookies offer no protection against this specific type of application-layer DDoS attack.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.