A DevOps engineer wants to provide secure network services to an IoT/cloud solution. Which of the following countermeasures should be implemented to mitigate network attacks that can render a network useless?

The question asks for a countermeasure against network attacks that can "render a network useless." This phrase directly describes the goal of a Denial of Service (DoS) or Distributed Denial of Service (DDoS) attack. These attacks overwhelm a network's resources, such as bandwidth or server capacity, with malicious traffic, making it unavailable to legitimate users. Therefore, implementing specific DoS/DDoS mitigation techniques, which are designed to detect and filter this malicious traffic, is the most direct and effective countermeasure to prevent the network from being rendered useless.

A. Network firewall: A standard firewall primarily provides access control based on rules. It can be overwhelmed by the sheer volume of traffic in a modern DDoS attack and is not its primary countermeasure.
C. Web application firewall (WAF): A WAF operates at the application layer (Layer 7) to protect against attacks like SQL injection. It does not protect the network infrastructure from volumetric attacks that cause outages.
D. Deep Packet Inspection (DPI): DPI is a technology for examining packet content, not a complete mitigation strategy itself. While it can be a component of a DDoS solution, it is not the overarching countermeasure.

1. University Courseware: Kurose

J. F.

& Ross

K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. In Chapter 1.6

"Network Security

" the text describes Denial-of-Service (DoS) attacks as assaults that "render a network

host

or other piece of infrastructure unusable by legitimate users" by flooding the resource with bogus traffic. This aligns directly with the question's scenario.

2. Vendor Documentation: Microsoft Azure. (2023). Overview of Azure DDoS Protection. Microsoft Docs. In the "About Azure DDoS Protection" section

the service is described as defending against "volumetric attacks" and "protocol attacks" that "attempt to make a resource unavailable to legitimate users." This is the specific countermeasure for the threat described.

3. Peer-Reviewed Academic Publication: Neshenko

N.

Bou-Harb

E.

Crichigno

J.

Kaddoum

G.

& Ghani

N. (2019). Demystifying IoT Security: An Exhaustive Survey on IoT Vulnerabilities and Defense Mechanisms. IEEE Communications Surveys & Tutorials

21(2)

1641-1681. In Section IV-A

"Denial of Service (DoS)

" the authors state

"The goal of a DoS attack is to make a network resource unavailable to its intended users... In the context of IoT

DoS attacks can render entire networks of devices inoperable." DOI: https://doi.org/10.1109/COMST.2018.2883222