DDoS protection filters disruptive traffic bursts before they saturate web servers
Given a scenario, secure a network in a cloud environment.
AnswerCorrect answer: B — DDoS protection scrubs the traffic floods at the edge, stopping disruptive volume before it can saturate the web servers.
An organization is hosting a cloud-based web server infrastructure that provides web-hosting solutions. Sudden continuous bursts of traffic have caused the web servers to saturate CPU and network utilizations. Which of the following should be implemented to prevent such disruptive traffic from reaching the web servers?
Traffic-flood questions ask where the flood can be stopped, and only DDoS protection is designed to drop malicious volume upstream of the origin.
Sudden continuous traffic bursts are saturating CPU and network utilization on a public web-hosting platform. A DDoS protection service absorbs and filters such floods at the edge, blocking the disruptive traffic before it can reach the web servers.
QoS (C) prioritizes traffic after it has arrived, which cannot help when the incoming volume itself is the attack and the servers are already saturated.
Community Discussion (4 comments)
reto1👍 1
B DDoS protection is specifically designed to detect and mitigate Distributed Denial of Service (DDoS) attacks, which can overwhelm web servers with excessive traffic. Implementing DDoS protection helps to filter out malicious traffic before it reaches the web servers, ensuring they remain operational during traffic spikes.
54a6b25👍 2
B. DDoS protection: Distributed Denial of Service (DDoS) protection is specifically designed to detect and mitigate large volumes of traffic that can overwhelm web servers. DDoS protection solutions can filter out malicious traffic, allowing legitimate traffic to reach the servers and ensuring continued availability and performance.
kuzummjakk👍 2
B is the most related, even though a "continuous burst of traffic" doesn't automatically mean DDoS. QoS is related to prioritizing specific internal traffic (phone calls), NAC worries about WHO's allowed in, DLP worries about what's allowed out, and microsegmentation is more of a zero-trust idea.
alittlesmarternow👍 1
DDoS Protection: This specifically targets distributed denial-of-service attacks, which are characterized by sudden and continuous bursts of traffic aimed at overwhelming web servers. It filters and mitigates malicious traffic before it reaches the servers,
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Log in to comment, report an error, or add a note about this question.
Expert Analysis
Why the Answer Is Correct
Sudden continuous bursts that saturate both CPU and network on a public web platform are the defining behavior of a distributed denial-of-service flood. DDoS protection services sit at the network edge, scrub or rate-limit the malicious volume, and forward only legitimate requests to the origin. That upstream filtering is exactly what the question asks for: preventing the disruptive traffic from ever reaching the web servers.
Why the Other Options Are Wrong
A, NAC and DLP, govern which devices may join the network and what data may leave it; neither controls the volume of unsolicited inbound internet traffic. C, QoS, prioritizes among traffic that has already reached your infrastructure, so it cannot shed a flood that is overwhelming the servers themselves. D, microsegmentation, contains east-west lateral movement inside the environment and does nothing about a north-south flood arriving from the internet.
Community Comment Notes
54a6b25 explains that DDoS protection detects and mitigates large traffic volumes, filtering malicious traffic while legitimate requests continue to flow. kuzummjakk works through the distractors precisely: QoS prioritizes internal traffic, NAC decides who gets in, DLP watches what goes out, and microsegmentation is a zero-trust east-west concept, leaving B as the fit even while noting a continuous burst is not automatically a DDoS. reto1 and alittlesmarternow reinforce the same edge-filtering logic.