CEH Practice Question: Malware, Social Engineering and Network Attacks
Which THREE of the following are valid methods for DDoS mitigation?
⚠ Common exam trap
Watch out — candidates often confuse mitigation techniques with configuration errors, such as thinking that increasing timeouts or disabling SYN cookies would help, when in fact these actions weaken defenses against specific attack vectors like SYN floods or slow HTTP attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rate limiting
Rate limiting is a valid DDoS mitigation method because it restricts the number of requests a server accepts from a single source within a given time window, preventing resource exhaustion. By enforcing thresholds (e.g., via iptables or application-layer rate limiters), it reduces the impact of volumetric attacks like HTTP floods without blocking legitimate traffic entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Rate limiting
Why this is correct
Rate limiting is a crucial DDoS mitigation technique that restricts the number of requests a server or application will accept from a specific source within a defined time window. By setting thresholds for connections, requests per second, or bandwidth usage, it prevents a single attacker or a small group of bots from overwhelming server resources. This method helps to differentiate between legitimate traffic spikes and malicious floods, allowing the system to maintain availability for valid users while shedding excessive, potentially harmful traffic.
- ✗
Increasing server timeout values
Why it's wrong here
Increasing server timeout values is counterproductive for DDoS mitigation, particularly against slow-drip or application-layer attacks. By extending the duration a server waits for a response before closing a connection, resources remain tied up for longer periods, making the server more vulnerable to resource exhaustion. This strategy exacerbates the problem by allowing attackers to consume more concurrent connections with fewer requests, rather than mitigating the attack.
- ✓
Scrubbing centers
Why this is correct
Scrubbing centers are specialized services designed to filter and clean malicious traffic before it reaches the intended target. Incoming network traffic is redirected to these centers, often via BGP Anycast or DNS changes, where advanced detection systems analyze it for known attack signatures, behavioral anomalies, and protocol violations. After identifying and dropping the malicious packets, the clean, legitimate traffic is then forwarded to the client's origin infrastructure, ensuring service continuity.
- ✗
Disabling SYN cookies
Why it's wrong here
Disabling SYN cookies would be a detrimental action for DDoS mitigation, as SYN cookies are a vital defense mechanism against SYN flood attacks. This technique allows a server to respond to a SYN request without allocating resources for the connection until the final ACK in the three-way handshake is received. By deferring state allocation, SYN cookies prevent an attacker from exhausting the server's connection table with spoofed or incomplete connection attempts, thus disabling them removes a critical layer of protection.
- ✓
Anycast routing
Why this is correct
Anycast routing is an effective DDoS mitigation strategy that leverages the network's routing infrastructure to distribute incoming traffic across multiple geographically dispersed servers or data centers that share the same IP address. When an Anycast IP is advertised from several locations, Border Gateway Protocol (BGP) directs client requests to the topologically closest available instance. This distribution mechanism effectively dilutes the impact of a large-volume attack by spreading the malicious traffic across numerous endpoints, preventing any single location from being overwhelmed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.