CEH Practice Question: Malware, Social Engineering and Network Attacks

A security team wants to mitigate a DNS amplification DDoS attack. Which of the following techniques would be MOST effective in preventing the attack from leveraging open DNS resolvers?

⚠ Common exam trap

A common mix-up: candidates confuse rate limiting or anycast as effective defenses, but the CEH exam specifically tests that the root cause of DNS amplification is open recursion, and disabling recursion is the most direct mitigation.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Disable recursion on DNS servers for external queries

Disabling recursion on DNS servers for external queries prevents them from acting as open resolvers. In a DNS amplification attack, the attacker sends a small query with a spoofed source IP to an open resolver, which then sends a large response to the victim. By blocking recursion for external clients, the server will only answer for domains it authoritatively hosts, thus eliminating the amplification vector.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Deploy a web application firewall
Why it's wrong here
Deploying a web application firewall (WAF) is ineffective against DNS amplification DDoS attacks because WAFs are designed to protect web applications by filtering HTTP/HTTPS traffic at Layer 7 of the OSI model. DNS amplification attacks, however, exploit the DNS protocol itself, typically over UDP port 53, by leveraging misconfigured open recursive DNS servers. A WAF lacks the protocol-specific inspection capabilities and placement within the network architecture to intercept or mitigate these types of infrastructure-level DNS attacks.
✓
Disable recursion on DNS servers for external queries
Why this is correct
Disabling recursion on DNS servers for external queries is the most effective direct mitigation against DNS amplification attacks. By configuring a DNS server to only perform recursive lookups for internal, trusted clients and to only respond authoritatively for its own zones to external requests, it prevents the server from acting as an open recursive resolver. This crucial configuration change eliminates the server's ability to be exploited by attackers to amplify small queries into large responses directed at a victim, thereby removing it as a participant in such attacks.
✗
Use anycast routing for DNS servers
Why it's wrong here
Using anycast routing for DNS servers, while beneficial for distributing load and improving resilience, does not inherently prevent a DNS server from being abused in an amplification attack. Anycast directs client requests to the nearest available server, enhancing performance and availability, but it does not alter the server's fundamental configuration regarding recursion. If the anycasted DNS server is still configured as an open recursive resolver, it remains susceptible to being exploited by attackers for amplification, regardless of the routing mechanism.
✗
Implement rate limiting on DNS responses
Why it's wrong here
Implementing rate limiting on DNS responses, such as Response Rate Limiting (RRL), can help reduce the impact of a DNS amplification attack but does not prevent the underlying amplification mechanism. While RRL can limit the number of identical responses a DNS server sends to a particular query source or destination within a specific timeframe, it does not address the core vulnerability of an open recursive resolver. The server can still participate in amplification, albeit at a throttled rate, and the fundamental misconfiguration remains unaddressed.

Visual reference

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question