Effective DDoS Attack Strategy for Concealment and Resistance

312-50v12 By islever Editorial Last updated

Denial-of-Service

Short answer

B The attacker should leverage a botnet to launch a Pulse Wave attack, sending high-volume traffic pulses at regular intervals.

Question

A well-resourced attacker intends to launch a highly disruptive DDoS attack against a major online retailer. The attacker aims to exhaust all the network resources while keeping their identity concealed. Their method should be resistant to simple defensive measures such as IP-based blocking. Based on these objectives, which of the following attack strategies would be most effective?
  1. The attacker should instigate a protocol-based SYN flood attack, consuming connection state tables on the retailer's servers
  2. The attacker should leverage a botnet to launch a Pulse Wave attack, sending high-volume traffic pulses at regular intervals Correct Answer
  3. The attacker should initiate a volumetric flood attack using a single compromised machine to overwhelm the retailer's network bandwidth
  4. The attacker should execute a simple ICMP flood attack from a single IP, exploiting the retailer's ICMP processing

Key Takeaways

The core test is identifying an attack vector that combines scale (botnet) with evasion techniques (pulsing) to maintain anonymity and resist mitigation, distinguishing it from simple brute-force flooding.

This question examines advanced Denial-of-Service (DoS) attack methodologies, specifically evaluating why a botnet-based Pulse Wave attack is superior to volumetric or protocol floods for evading detection. It establishes that distributed traffic with intermittent pulses effectively bypasses simple IP blocking and standard rate-limiting defenses.

Common mistake: Learners often select ICMP or SYN floods because they are common textbook examples of DoS attacks; however, these are easily mitigated by single-source IP blocking and lack the distributed nature required for high resilience against modern defenses.

Expert Analysis

Why the Answer Is Correct

Option B is the correct answer because it addresses all three constraints: resource exhaustion, identity concealment, and resistance to IP-based blocking. A botnet provides the necessary distributed infrastructure to hide the true source of the attack (concealment) and generate massive volume. The 'Pulse Wave' technique involves sending traffic in bursts followed by pauses, which prevents static threshold-based firewalls and rate limiters from triggering consistently, making it resistant to simple defensive measures.

Why the Other Options Are Wrong

Options C and D involve single compromised machines or single IPs. These are trivially blocked via IP blacklisting, failing the requirement for resistance to simple defenses. Option A, a SYN flood, targets connection state tables but is also typically mitigated by SYN cookies or rate limiting on specific ports. While effective at exhaustion, it lacks the sophisticated evasion characteristics of the Pulse Wave strategy described in B.

Community Comment Notes

Community consensus strongly favors B, noting that keywords like 'DDOS', 'botnet', and 'Pulse Wave' align with the requirements for concealment and anti-blocking. One user noted that while D offers anonymity via spoofing, it fails the 'resistant to simple defensive measures' criterion because single-IP floods are easy to block. Another comment highlighted that the Pulse Wave's alternating intensity makes it challenging for traditional mitigation techniques to detect effectively.

Exam Strategy

When analyzing DDoS questions, prioritize solutions that offer both scale (distributed/botnet) and sophistication (evasion/pulsing). If an option relies on a single source or a basic protocol abuse without mentioning distribution or evasion techniques, it is likely incorrect for scenarios requiring concealment and resilience.

Frequently Asked Questions

Why is a SYN flood not the best answer here?

SYN floods are easily mitigated by SYN cookies and are often traceable to specific IPs if not properly masked. They lack the distributed scale and pulsing evasion needed for the scenario.

How does a Pulse Wave attack evade detection?

It sends traffic in bursts followed by quiet periods. This prevents static thresholds from triggering alerts continuously, allowing the attack to blend in with normal traffic fluctuations.

More 312-50v12 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. insaniunt 👍 2 Answered B
    B. The attacker should leverage a botnet to launch a Pulse Wave attack, sending high-volume traffic pulses at regular intervals A Pulse Wave DDoS attack is a sophisticated variation that involves alternating periods of attack intensity and brief pauses, making it more challenging for traditional mitigation techniques to detect and respond effectively. This approach can help the attacker achieve their objective of exhausting network resources while concealing their identity. Additionally, leveraging a botnet enhances the attacker's ability to generate a massive volume of traffic, making it even more challenging for the targeted online retailer to mitigate the attack.
  2. qwerty100 👍 2 Answered B
    It's b B. The attacker should leverage a botnet to launch a Pulse Wave attack, sending high-volume traffic pulses at regular intervals The clues are: - keeping their identity concealed - resistant to simple defensive measures such as IP-based blocking
  3. ldixon84304 👍 1
    I was thinking it was "D" due to anonymity being a requirement.
  4. qtygbapjpesdayazko 👍 1 Answered B
    Keyword "DDOS. so is botnet to launch a Pulse Wave attack.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide