ISC2 CC Business Continuity, DR & Incident Response Practice Question
An online retailer has a DR plan that includes active-active data centers. During a major DDoS attack, one data center's external connectivity is saturated. The internal network is operational. The security team has identified the attack traffic pattern and is working with the ISP to filter. To maintain service availability, what action should be taken?
⚠ Common exam trap
ISC2 often tests the misconception that shutting down a data center is the safest failover action during a DDoS, but the trap here is that active-active designs require keeping both sites operational to maintain capacity and redundancy, and scrubbing centers are the correct mitigation technique for external saturation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Redirect all traffic to a cloud-based scrubbing center.
A cloud-based scrubbing center (DDoS mitigation service) can filter malicious traffic before it reaches the retailer's network, preserving the active-active data center architecture. Since the internal network is operational, the attack only saturates external connectivity; redirecting traffic to the scrubbing center allows clean traffic to be re-injected into the data centers, maintaining service availability without taking any site offline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Shut down the attacked data center and fail all traffic to the other data center.
Why it's wrong here
Could overload the other site and cause performance issues.
- ✓
Redirect all traffic to a cloud-based scrubbing center.
Why this is correct
Filters attack traffic and maintains service availability.
- ✗
Implement rate limiting on the affected network segment.
Why it's wrong here
May block legitimate users and not fully mitigate the attack.
- ✗
Continue monitoring and let the ISP handle the attack.
Why it's wrong here
Passive approach may result in prolonged downtime.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
DDoS
A DDoS (Distributed Denial-of-Service) attack is a malicious attempt to disrupt normal traffic of a targeted server, service, or network by overwhelming it with a flood of internet traffic from multiple compromised systems.
Key term
Distributed Denial-of-service
A cyberattack where many compromised computers flood a target system with traffic, making it unavailable to legitimate users.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.