312-39 practice question 4 of 35

Which of the following technique protects from flooding attacks originated from the valid prefixes (IP addresses) so that they can be traced to its true source?

Full set: 100 questions

Answer options

A: Rate Limiting

B: Egress Filtering

C: Ingress Filtering Correct answer

D: Throttling

Correct Answer:

C. Ingress Filtering

Explanation

Ingress filtering is a network security technique used on routers to verify that incoming packets are actually from the IP addresses they claim to be from. By ensuring that packets have a legitimate source IP address that matches the network it is coming from (valid prefixes), it prevents attackers from using spoofed IP addresses. This makes it possible to trace malicious traffic, such as flooding attacks, back to its true origin, as the source IP address is not falsified. This technique is a fundamental defense against various denial-of-service attacks.

Why Incorrect

A. Rate Limiting: This controls the amount of traffic allowed over a period, but it does not validate the source IP address or prevent spoofing.
B. Egress Filtering: This technique is applied to outgoing traffic to prevent internal users from launching attacks with spoofed IP addresses, not to protect against incoming attacks.
D. Throttling: Similar to rate limiting, this manages traffic volume to prevent system overload but does not involve source IP address validation.

References

1. Ferguson, P., & Senie, D. (2000). Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing. RFC 2827. The Internet Society. Retrieved from https://tools.ietf.org/html/rfc2827. (This entire document describes the principle).

2. Baker, F., & Savola, P. (2004). Ingress Filtering for Multihomed Networks. RFC 3704. The Internet Society. Section 1.

3. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 8.9, "Network Security," discusses source IP spoofing and filtering defenses.

Question breakdown

Tests: DoS/DDoS mitigation through network filtering
Difficulty: Medium

Key idea: Ingress filtering drops packets whose source addresses do not belong to valid prefixes, which prevents spoofing and keeps flooding traffic traceable to its true source.

How to reach the answer

The clue is 'valid prefixes' combined with 'traced to its true source', which points to anti-spoofing.
Ingress filtering (RFC 2827/BCP 38) allows only traffic from legitimate source prefixes.
Because spoofed sources are dropped, any flood that gets through comes from real, traceable addresses.
Rate limiting and throttling reduce traffic volume but do nothing for traceability.

Each option

AIncorrect. Rate limiting caps traffic volume but does not validate source addresses.
BIncorrect. Egress filtering controls traffic leaving a network; the term used for validating source prefixes in this context is ingress filtering.
CCorrect. Ingress filtering enforces valid source prefixes, so flooding traffic can be traced to its true origin.
DIncorrect. Throttling slows request rates and provides no source validation or traceback.

Common trap: Egress filtering also blocks spoofed packets at the network edge, so candidates confuse which direction the exam's definition uses.

In practice: ISPs and enterprise edge routers apply BCP 38 ingress filtering or uRPF to drop spoofed-source packets. This supports DDoS traceback and abuse reporting.

Remember: Source prefix validation for traceability means ingress filtering (BCP 38).

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free 312-39 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test