DDoS protection filters disruptive traffic bursts before they saturate web servers
Short answer
B DDoS protection scrubs the traffic floods at the edge, stopping disruptive volume before it can saturate the web servers.
Question
Key Takeaways
Traffic-flood questions ask where the flood can be stopped, and only DDoS protection is designed to drop malicious volume upstream of the origin.
Sudden continuous traffic bursts are saturating CPU and network utilization on a public web-hosting platform. A DDoS protection service absorbs and filters such floods at the edge, blocking the disruptive traffic before it can reach the web servers.
Common mistake: QoS (C) prioritizes traffic after it has arrived, which cannot help when the incoming volume itself is the attack and the servers are already saturated.
Expert Analysis
Why the Answer Is Correct
Sudden continuous bursts that saturate both CPU and network on a public web platform are the defining behavior of a distributed denial-of-service flood. DDoS protection services sit at the network edge, scrub or rate-limit the malicious volume, and forward only legitimate requests to the origin. That upstream filtering is exactly what the question asks for: preventing the disruptive traffic from ever reaching the web servers.
Why the Other Options Are Wrong
A, NAC and DLP, govern which devices may join the network and what data may leave it; neither controls the volume of unsolicited inbound internet traffic. C, QoS, prioritizes among traffic that has already reached your infrastructure, so it cannot shed a flood that is overwhelming the servers themselves. D, microsegmentation, contains east-west lateral movement inside the environment and does nothing about a north-south flood arriving from the internet.
Community Comment Notes
54a6b25 explains that DDoS protection detects and mitigates large traffic volumes, filtering malicious traffic while legitimate requests continue to flow. kuzummjakk works through the distractors precisely: QoS prioritizes internal traffic, NAC decides who gets in, DLP watches what goes out, and microsegmentation is a zero-trust east-west concept, leaving B as the fit even while noting a continuous burst is not automatically a DDoS. reto1 and alittlesmarternow reinforce the same edge-filtering logic.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
54a6b25 👍 2B. DDoS protection: Distributed Denial of Service (DDoS) protection is specifically designed to detect and mitigate large volumes of traffic that can overwhelm web servers. DDoS protection solutions can filter out malicious traffic, allowing legitimate traffic to reach the servers and ensuring continued availability and performance.
-
kuzummjakk 👍 2B is the most related, even though a "continuous burst of traffic" doesn't automatically mean DDoS. QoS is related to prioritizing specific internal traffic (phone calls), NAC worries about WHO's allowed in, DLP worries about what's allowed out, and microsegmentation is more of a zero-trust idea.
-
reto1 👍 1B DDoS protection is specifically designed to detect and mitigate Distributed Denial of Service (DDoS) attacks, which can overwhelm web servers with excessive traffic. Implementing DDoS protection helps to filter out malicious traffic before it reaches the web servers, ensuring they remain operational during traffic spikes.
-
alittlesmarternow 👍 1DDoS Protection: This specifically targets distributed denial-of-service attacks, which are characterized by sudden and continuous bursts of traffic aimed at overwhelming web servers. It filters and mitigates malicious traffic before it reaches the servers,
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.