Which of the following technique protects from flooding attacks originated from the valid prefixes (IP addresses) so that they can be traced to its…

Question breakdown

Tests

DoS/DDoS mitigation through network filtering

Difficulty

Medium

Key idea: Ingress filtering drops packets whose source addresses do not belong to valid prefixes, which prevents spoofing and keeps flooding traffic traceable to its true source.

How to reach the answer

1. The clue is 'valid prefixes' combined with 'traced to its true source', which points to anti-spoofing.
2. Ingress filtering (RFC 2827/BCP 38) allows only traffic from legitimate source prefixes.
3. Because spoofed sources are dropped, any flood that gets through comes from real, traceable addresses.
4. Rate limiting and throttling reduce traffic volume but do nothing for traceability.

Each option

• AIncorrect. Rate limiting caps traffic volume but does not validate source addresses.
• BIncorrect. Egress filtering controls traffic leaving a network; the term used for validating source prefixes in this context is ingress filtering.
• CCorrect. Ingress filtering enforces valid source prefixes, so flooding traffic can be traced to its true origin.
• DIncorrect. Throttling slows request rates and provides no source validation or traceback.

Common trap: Egress filtering also blocks spoofed packets at the network edge, so candidates confuse which direction the exam's definition uses.

In practice: ISPs and enterprise edge routers apply BCP 38 ingress filtering or uRPF to drop spoofed-source packets. This supports DDoS traceback and abuse reporting.

Remember: Source prefix validation for traceability means ingress filtering (BCP 38).

Drafted with AI assistance and checked against the answer key.