Preventing DDoS on Smart City IoT Networks
You are a cybersecurity consultant for a smart city project. The project involves deploying a vast network of IoT devices for public utilities like traffic control, water supply, and power grid management. The city administration is concerned about the possibility of a Distributed Denial of Service (DDoS) attack crippling these critical services. They have asked you for advice on how to prevent such an attack. What would be your primary recommendation?
Community Votes
67% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the distinction between detection (IDS) and prevention mechanisms, with the common trap being the selection of IDS due to its association with security monitoring rather than active blocking.
This question addresses the primary recommendation for preventing Distributed Denial of Service (DDoS) attacks on critical IoT infrastructure. It establishes that while detection is important, proactive traffic filtering via IP whitelisting is the preferred prevention strategy in this specific exam context.
Many candidates choose C (Deploy network intrusion detection systems) because they confuse IDS (detection only) with IPS (prevention), or believe IDS can mitigate attacks via rate limiting, failing to recognize that IDS does not block traffic by default.
Community Discussion (9 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is D: Implement IP address whitelisting for all IoT devices. In the context of this specific certification exam (EC-Council CEH), IP whitelisting is considered a robust preventive measure for known, static IoT devices. By allowing only pre-approved IP addresses to communicate with the critical infrastructure, unauthorized traffic—including spoofed DDoS sources—is blocked at the perimeter before it consumes resources. This aligns with the principle of 'least privilege' and strict access control for embedded systems.Why the Other Options Are Wrong
Option A (Firmware updates) and Option B (Strong passwords) are essential for general device security but do not directly prevent a volumetric DDoS attack from reaching the network interface. Option C (Deploy IDS) is the most significant distractor; however, an Intrusion Detection System is designed to monitor and alert on suspicious activity, not to actively drop packets or block traffic in real-time without integration into an IPS or firewall. While some modern IDS/IPS hybrids exist, the option explicitly states 'IDS,' making it a detection tool rather than a prevention one.Community Comment Notes
Community feedback highlights the debate between detection and prevention. Several users noted that "IDS Detects while an IPS prevents," reinforcing why C is incorrect for prevention. Others argued that "whitelisting is useless if DDOS use spoofed IP," pointing out a technical limitation of whitelisting against sophisticated spoofing attacks. However, the exam logic prioritizes the concept of restricting access to trusted entities as the primary defense layer for controlled environments like smart city utilities.Exam Strategy
When asked about 'prevention' vs 'detection', always look for keywords indicating active blocking (e.g., Firewall, IPS, Whitelisting, Blacklisting). If the option says 'IDS', it is almost certainly a detection-only choice unless specified as 'IPS'. For IoT questions, consider the scale and management overhead; while whitelisting is hard to manage at scale, exams often favor it for high-security, low-mobility scenarios.
Frequently Asked Questions
Why is IDS not a prevention mechanism?
An IDS monitors traffic and generates alerts but does not actively block packets. An IPS or firewall is required for active prevention.
Is whitelisting practical for thousands of IoT devices?
In real-world large-scale deployments, managing whitelists can be difficult. However, for exam purposes, it represents the strongest access control method for static IoT assets.