Preventing DDoS on Smart City IoT Networks

312-50v12 By islever Editorial Last updated

Denial-of-Service

Short answer

D Implement IP address whitelisting for all IoT devices to ensure only authorized traffic reaches the critical infrastructure.

Question

You are a cybersecurity consultant for a smart city project. The project involves deploying a vast network of IoT devices for public utilities like traffic control, water supply, and power grid management. The city administration is concerned about the possibility of a Distributed Denial of Service (DDoS) attack crippling these critical services. They have asked you for advice on how to prevent such an attack. What would be your primary recommendation?
  1. Implement regular firmware updates for all IoT devices.
  2. Establish strong, unique passwords for each IoT device.
  3. Deploy network intrusion detection systems (IDS) across the IoT network.
  4. Implement IP address whitelisting for all IoT devices. Correct Answer

Key Takeaways

The question tests the distinction between detection (IDS) and prevention mechanisms, with the common trap being the selection of IDS due to its association with security monitoring rather than active blocking.

This question addresses the primary recommendation for preventing Distributed Denial of Service (DDoS) attacks on critical IoT infrastructure. It establishes that while detection is important, proactive traffic filtering via IP whitelisting is the preferred prevention strategy in this specific exam context.

Common mistake: Many candidates choose C (Deploy network intrusion detection systems) because they confuse IDS (detection only) with IPS (prevention), or believe IDS can mitigate attacks via rate limiting, failing to recognize that IDS does not block traffic by default.

Expert Analysis

Why the Answer Is Correct

The correct answer is D: Implement IP address whitelisting for all IoT devices. In the context of this specific certification exam (EC-Council CEH), IP whitelisting is considered a robust preventive measure for known, static IoT devices. By allowing only pre-approved IP addresses to communicate with the critical infrastructure, unauthorized traffic—including spoofed DDoS sources—is blocked at the perimeter before it consumes resources. This aligns with the principle of 'least privilege' and strict access control for embedded systems.

Why the Other Options Are Wrong

Option A (Firmware updates) and Option B (Strong passwords) are essential for general device security but do not directly prevent a volumetric DDoS attack from reaching the network interface. Option C (Deploy IDS) is the most significant distractor; however, an Intrusion Detection System is designed to monitor and alert on suspicious activity, not to actively drop packets or block traffic in real-time without integration into an IPS or firewall. While some modern IDS/IPS hybrids exist, the option explicitly states 'IDS,' making it a detection tool rather than a prevention one.

Community Comment Notes

Community feedback highlights the debate between detection and prevention. Several users noted that "IDS Detects while an IPS prevents," reinforcing why C is incorrect for prevention. Others argued that "whitelisting is useless if DDOS use spoofed IP," pointing out a technical limitation of whitelisting against sophisticated spoofing attacks. However, the exam logic prioritizes the concept of restricting access to trusted entities as the primary defense layer for controlled environments like smart city utilities.

Exam Strategy

When asked about 'prevention' vs 'detection', always look for keywords indicating active blocking (e.g., Firewall, IPS, Whitelisting, Blacklisting). If the option says 'IDS', it is almost certainly a detection-only choice unless specified as 'IPS'. For IoT questions, consider the scale and management overhead; while whitelisting is hard to manage at scale, exams often favor it for high-security, low-mobility scenarios.

Frequently Asked Questions

Why is IDS not a prevention mechanism?

An IDS monitors traffic and generates alerts but does not actively block packets. An IPS or firewall is required for active prevention.

Is whitelisting practical for thousands of IoT devices?

In real-world large-scale deployments, managing whitelists can be difficult. However, for exam purposes, it represents the strongest access control method for static IoT assets.

More 312-50v12 FAQ →

Community Votes

D
67%
C
33%

67% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. qtygbapjpesdayazko 👍 3 Answered D
    D. Implement IP address whitelisting for all IoT devices. IDS is for detection, not prevention (IPS), so a whitelisting is the way for a good prevention.
  2. qwerty100 👍 3 Answered D
    D. Implement IP address whitelisting for all IoT devices. IDSs can't stop DDOS
  3. insaniunt 👍 2 Answered C
    C. Deploy network intrusion detection systems (IDS) across the IoT network. While maintaining the security of IoT devices involves various measures, in the context of preventing Distributed Denial of Service (DDoS) attacks on a smart city's IoT infrastructure, deploying network intrusion detection systems (IDS) would be a crucial recommendation
  4. sam_kdr 👍 1 Answered C
    Answer C provides proactive monitoring to detect unusual traffic patterns indicative of DDoS attacks; while options A and B contribute to securing devices, and D improves access control, deploying IDS focuses specifically on identifying and mitigating attacks in real-time.
  5. agelbahri 👍 1 Answered D
    IP Whitelisting ensures that only trusted devices and networks can communicate with the IoT devices. By blocking unauthorized traffic before it even reaches the devices, this measure directly prevents many types of DDoS attacks.
Show 4 more comments
  1. MPA3333 👍 1
    D is not possible, how do you manage whitelisting of (maybe) hundreds or thousands and IoT devices ? I would vote for C.
  2. d02c2d5 👍 1 Answered C
    Some IDS have rate limit option. Besides Implementing a white list is useless if DDOS use spoofed IP
  3. rorahir 👍 1
    Ethical hacking specialists could you please check if this approach is correct"
  4. sumanroy 👍 1 Answered D
    IDS Detects while an IPS prevents, so it should be D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide