hardMultiple ChoiceObjective-mapped
CCSP Practice Question: An e-commerce company uses a cloud-based web…
An e-commerce company uses a cloud-based web application firewall (WAF) to protect against common web exploits. The security team notices that a specific IP address is sending a high volume of requests that appear to be a DDoS attack. What is the best immediate response to mitigate the attack while minimizing impact on legitimate users?
⚠ Common exam trap
ISC2 often tests the misconception that blocking an IP address (Option C) is the safest immediate action, but the trap is that legitimate users can share the same IP via NAT or proxy, making rate limiting a more precise and less harmful control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement rate limiting on the IP address with a threshold that allows normal traffic.
Rate limiting at the WAF allows the security team to restrict the volume of requests from the offending IP address without completely blocking it. This approach ensures that legitimate traffic from that IP (e.g., a shared NAT gateway or a user with a dynamic IP) can still pass through, while the DDoS attack traffic is throttled. WAFs typically support granular rate-limiting rules based on IP, session, or URI, making this the most precise and least disruptive immediate response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the DNS to point to a different IP address.
Why it's wrong here
This is a slow reaction and does not stop the attack from the same source.
- ✗
Increase the compute capacity of the web servers.
Why it's wrong here
Scaling up may help absorb traffic but does not mitigate the attack and can be expensive.
- ✗
Block the IP address in the WAF.
Why it's wrong here
Blocking an IP may affect legitimate users sharing that IP, and attackers can easily change IPs.
- ✓
Implement rate limiting on the IP address with a threshold that allows normal traffic.
Why this is correct
Rate limiting can distinguish between human users and automated attacks, reducing impact.
Visual reference
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.