CEH Practice Question: Malware, Social Engineering and Network Attacks

An organization wants to mitigate the impact of a DDoS attack by distributing incoming traffic across multiple servers in different geographic locations. Which technique is BEST suited?

⚠ Common exam trap

Candidates often confuse 'load balancing' with 'geographic distribution,' but traditional load balancers (e.g., round-robin DNS or hardware LB) do not inherently provide DDoS mitigation because they concentrate traffic in a single region or rely on a central LB that can be attacked.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Anycast

Anycast routing allows the same IP address to be advertised from multiple geographically dispersed servers. When a DDoS attack occurs, traffic is naturally distributed to the nearest or least congested anycast node, effectively absorbing and dispersing the attack load across the global infrastructure. This technique is specifically designed to mitigate volumetric DDoS attacks by leveraging BGP to route traffic to the closest available server, preventing any single server from being overwhelmed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Anycast
Why this is correct
Anycast routing effectively mitigates DDoS attacks by advertising the same IP address from multiple geographically dispersed servers. When a client initiates a connection, BGP (Border Gateway Gateway Protocol) directs traffic to the topologically nearest available Anycast node. This distribution dilutes the attack volume across numerous points of presence, making it significantly harder for attackers to overwhelm a single target and ensuring service continuity by absorbing the attack across a wide area.
✗
Scrubbing center
Why it's wrong here
A scrubbing center is a specialized facility designed to analyze and filter incoming network traffic, identifying and dropping malicious packets associated with DDoS attacks. While highly effective at cleaning traffic, its primary function is not to geographically distribute the attack load across multiple ingress points. Instead, it centralizes the filtering process, often requiring traffic to be rerouted to the center, which doesn't inherently leverage distributed infrastructure to absorb the initial attack volume across a wide area.
✗
Rate limiting
Why it's wrong here
Rate limiting involves setting thresholds on the number of requests or connections permitted from a specific source IP address or within a defined time frame. While it can prevent individual attackers or misconfigured clients from monopolizing resources, it is largely ineffective against sophisticated, high-volume distributed denial-of-service (DDoS) attacks. A massive influx of traffic from numerous spoofed or legitimate-looking sources can easily overwhelm rate-limiting mechanisms before they can effectively block the malicious traffic, as it doesn't distribute the attack load across multiple geographic points.
✗
Load balancing
Why it's wrong here
Traditional load balancing distributes incoming network traffic efficiently among multiple servers or resources within a single data center or local cluster to optimize resource utilization and maximize throughput. While crucial for high availability and performance, it does not inherently provide geographical distribution of the attack surface. A DDoS attack targeting a specific data center would still concentrate its volume on that single location, potentially overwhelming the local load balancers and backend servers, as it lacks the wide-area traffic absorption capabilities of a globally distributed system.

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question