Effective DDoS Mitigation Techniques: Rate Limiting, Scrubbing Centers, Anycast
Which THREE of the following are effective DDoS mitigation techniques? (Choose 3)
Quick Answer
The answer is rate limiting, scrubbing centers, and anycast. Rate limiting works by capping the number of requests from a single source, preventing any one attacker from overwhelming the server, while scrubbing centers act as a centralized filter that inspects and removes malicious traffic before it reaches the target, and anycast disperses incoming traffic across multiple geographically distributed nodes to absorb and dilute the attack volume. On the Certified Ethical Hacker CEH exam, this question tests your understanding of network defense layers, often appearing in the system hacking or denial-of-service sections; a common trap is confusing scrubbing centers with simple firewalls or mistaking anycast for a routing protocol rather than a traffic distribution technique. Remember the mnemonic “RSA” for Rate limit, Scrub, Anycast to recall the three pillars of DDoS mitigation.
⚠ Common exam trap
A common mix-up: candidates confuse MAC address filtering (a Layer 2 security control) with effective DDoS mitigation, or mistakenly think disabling DHCP (a network configuration protocol) can stop an attack, when in reality DDoS mitigation requires scalable, network-level techniques like scrubbing, anycast, and rate limiting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scrubbing centers
Scrubbing centers are effective DDoS mitigation because they act as a centralized traffic-cleaning facility. When an attack is detected, malicious traffic is diverted to the scrubbing center, where it is filtered using signature-based, anomaly-based, and rate-based techniques, allowing only legitimate traffic to pass through to the target network. This offloads the attack burden from the victim's infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MAC address filtering
Why it's wrong here
MAC filtering is not effective against DDoS as MACs can be spoofed.
- ✓
Scrubbing centers
Why this is correct
Dedicated infrastructure filters out attack traffic.
- ✓
Anycast routing
Why this is correct
Distributes traffic across multiple data centers to absorb attacks.
- ✓
Rate limiting
Why this is correct
Limits the rate of traffic from a source to mitigate flood attacks.
- ✗
Disabling DHCP
Why it's wrong here
DHCP is unrelated to DDoS mitigation.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are common methods used to mitigate DDoS attacks? (Select 3)
hard- A.MAC flooding
- ✓ B.Rate limiting
- ✓ C.Scrubbing centers
- D.ARP poisoning
- ✓ E.Anycast network distribution
Why B: Rate limiting is a common mitigation technique that restricts the number of requests a server or network device will accept from a specific source within a given time window. By enforcing thresholds (e.g., packets per second), it prevents any single source from overwhelming the target, effectively reducing the impact of volumetric DDoS attacks.
Variation 2. A company's security team wants to deploy a DDoS mitigation technique that distributes incoming traffic across multiple servers in different geographic locations, making it harder for an attacker to overwhelm a single target. Which technique BEST fits this description?
medium- ✓ A.Anycast network
- B.Rate limiting
- C.Load balancer
- D.Scrubbing center
Why A: Anycast network routing allows the same IP address to be advertised from multiple geographically distributed servers. When traffic arrives, BGP (Border Gateway Protocol) automatically directs each packet to the nearest or best-path server, effectively spreading the load and absorbing volumetric DDoS attacks by preventing any single server from becoming a bottleneck.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.