CEH Practice Question: Malware, Social Engineering and Network Attacks

An organization wants to mitigate the impact of a DDoS attack that uses large volumes of UDP traffic to exhaust bandwidth. Which of the following techniques would be MOST effective?

⚠ Common exam trap

Many exam-takers confuse rate limiting as a universal solution, but it fails against volumetric UDP floods because it cannot differentiate attack traffic from legitimate UDP services, whereas a scrubbing center provides intelligent traffic filtering at scale.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Deploying a scrubbing center

A scrubbing center is the most effective technique because it filters out malicious UDP traffic from legitimate traffic by analyzing packet characteristics, such as source IP reputation and payload patterns, before forwarding clean traffic to the target network. This approach preserves legitimate UDP services (e.g., DNS, VoIP) while absorbing volumetric attacks, unlike simpler methods that may block all UDP or fail to scale.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Rate limiting on all ports
Why it's wrong here
Rate limiting, when applied indiscriminately across all ports, can indeed reduce the volume of incoming traffic during a DDoS attack. However, this approach lacks the intelligence to differentiate between malicious and legitimate requests, leading to significant collateral damage. It often results in legitimate user traffic being dropped or severely delayed, effectively causing a self-inflicted denial of service for genuine users while only partially mitigating the attack.
✓
Deploying a scrubbing center
Why this is correct
Deploying a scrubbing center is a highly effective strategy for mitigating DDoS attacks, particularly those involving high-volume UDP floods. These specialized facilities act as an intermediary, diverting all incoming traffic through advanced analysis systems that inspect packet headers and payloads for known attack patterns and anomalies. Malicious traffic is then filtered out, while legitimate requests are forwarded to the organization's infrastructure, ensuring business continuity without disrupting genuine user access.
✗
Blocking all UDP traffic
Why it's wrong here
Completely blocking all UDP traffic is an overly aggressive and impractical mitigation strategy for a DDoS attack. While some DDoS attacks leverage UDP, many critical internet services, such as Domain Name System (DNS) lookups, Voice over IP (VoIP) communications, and online gaming, rely heavily on UDP for efficient, low-latency data transmission. Indiscriminately blocking all UDP traffic would severely disrupt or entirely disable these essential legitimate services, making it an unacceptable solution for most organizations.
✗
Implementing SYN cookies
Why it's wrong here
Implementing SYN cookies is a specific defense mechanism designed to protect against TCP SYN flood attacks, which exploit the three-way handshake process. SYN cookies work by deferring the allocation of server resources until the client's final ACK in the handshake is received, preventing the server from exhausting its connection table. However, since the question implies a general DDoS attack, and many common DDoS vectors (like UDP floods) do not involve TCP handshakes, SYN cookies offer no protection against non-TCP-based volumetric attacks.

Visual reference

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question