CEH Network and Web Application Attacks Practice Question
You are a security analyst for a medium-sized e-commerce company. The company hosts its web application on a single server running Apache on Ubuntu. Recently, the operations team noticed that the server's CPU usage spikes to 100% every few minutes, causing the website to become unresponsive. They have ruled out hardware issues. The web server logs show repeated requests to the same URL with varying parameters, such as /product?id=1, /product?id=2, etc., all originating from a single IP address. Each request returns a 200 OK response, but the server takes several seconds to generate the page. The application uses a relational database backend with an ORM. You suspect an attack is occurring. What is the most likely attack and the best immediate course of action?
⚠ Common exam trap
EC-Council often tests the distinction between immediate containment (blocking the IP) and long-term hardening (WAF, rate limiting, input validation), and the trap here is that candidates choose a more 'secure' but slower solution like a WAF or input validation, missing the urgency of stopping the active attack first.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block the IP address of the attacker at the firewall
The attack is a resource exhaustion or application-layer DoS attack, where repeated requests to a database-backed endpoint (e.g., /product?id=1, /product?id=2) cause high CPU usage due to expensive ORM queries. The immediate best course is to block the single attacking IP at the firewall, as it stops the malicious traffic at the network perimeter with minimal overhead, preserving server resources for legitimate users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement rate limiting on the /product endpoint
Why it's wrong here
Implementing rate limiting on the /product endpoint would indeed reduce the volume of requests processed per unit of time, thereby mitigating the *impact* of the resource exhaustion attack. However, it does not *immediately stop* the attacker's ability to consume resources entirely. The malicious actor could still continue sending requests, albeit at a throttled rate, potentially prolonging the attack and still exhausting resources over a longer period, failing to provide the immediate cessation required.
- ✓
Block the IP address of the attacker at the firewall
Why this is correct
Blocking the attacker's IP address directly at the firewall provides the most immediate and effective containment for an ongoing resource exhaustion attack originating from a single source. A firewall operates at the network layer, allowing it to drop all packets from the specified IP address before they even reach the web server or application. This action instantly severs the attacker's connection and prevents any further malicious requests from impacting the application's availability, making it the optimal immediate response.
- ✗
Install a web application firewall (WAF) to detect and block malicious requests
Why it's wrong here
While installing a Web Application Firewall (WAF) is an excellent strategic measure for enhancing application security and detecting various types of malicious requests, it is not an immediate solution for an active, ongoing resource exhaustion attack. Deploying and properly configuring a WAF, including defining rules specific to the current attack pattern, requires significant time and expertise. This delay means the attack would likely continue to impact services during the WAF's setup phase, rendering it unsuitable for immediate incident response.
- ✗
Apply input validation to ensure product IDs are positive integers
Why it's wrong here
Applying input validation to ensure product IDs are positive integers is a fundamental security best practice that helps prevent various injection attacks and ensures data integrity. However, this measure is primarily preventive and does not address the core issue of an ongoing resource exhaustion attack where the attacker is sending a high volume of *valid* requests. The attacker can simply continue to send numerous requests with perfectly valid product IDs, still overwhelming the server and exhausting its resources, making it ineffective for immediate attack cessation.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.