Certified Incident Handler (CIH) Practice Ecam

Which practice assists an incident responder in defending the network against DoS/DDoS incidents?

1. Preventing transmission of fraudulently addressed packets

2. Increasing bandwidth capacity

3. Overhauling security infrastructure

4. Implementing rate-limiting measures

The correct answer is: Preventing transmission of fraudulently addressed packets

Defending against DoS (Denial of Service) and DDoS (Distributed Denial of Service) incidents primarily focuses on mitigating the effects of potentially overwhelming traffic aimed at disrupting service. Implementing rate-limiting measures is a proven method for managing and controlling the flow of network traffic, allowing responders to set thresholds that can prevent any single user from consuming too much bandwidth. This practice can effectively limit the impact of an attack by slowing down or distributing the requests per user, thus protecting the system from being overwhelmed by excessive traffic. While preventing the transmission of fraudulently addressed packets is relevant in a broader cybersecurity context, it does not target the specific traffic overload that characterizes DoS/DDoS attacks. Increasing bandwidth capacity could help absorb attacks but might not be a sustainable solution. Overhauling security infrastructure might improve overall security, but it does not directly address the immediate threats posed by DDoS attacks. Therefore, rate-limiting measures stand out as a strategic defense mechanism specifically tailored to mitigate the effects of these disruptive incidents.