Which of the following methods is an IoT portal administrator most likely to use in order to mitigate Distributed Denial of Service (DDoS) attacks?

Traffic scrubbing is a primary and highly effective method for mitigating Distributed Denial of Service (DDoS) attacks. This technique diverts all incoming traffic, including the malicious attack traffic, to a specialized third-party "scrubbing center" or an upstream Internet Service Provider (ISP) facility. At this location, the traffic is analyzed, and malicious packets are identified and dropped ("scrubbed"). Only the clean, legitimate traffic is then forwarded to the IoT portal's servers. This prevents the organization's own network perimeter and internet connection from being saturated and overwhelmed by the sheer volume of a DDoS attack, ensuring service availability for legitimate users.

A. DNSSEC authenticates DNS responses to prevent spoofing and cache poisoning; it does not mitigate volumetric traffic floods characteristic of DDoS attacks.

B. Disabling NAT-T impacts the functionality of IPsec VPNs traversing NAT devices and is not a mechanism for mitigating DDoS attacks.

D. IPSec is used to encrypt and authenticate data packets between two endpoints but does not prevent a volumetric attack from overwhelming a server's resources.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide. Section 3.4.4

"Denial of Service

" states that for large-scale attacks

an organization may need assistance from its ISP

which aligns with the principle of upstream traffic scrubbing. Available at: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

2. Carnegie Mellon University. (2021). 18-730: Introduction to Computer Security

Lecture 15: Network Security & Denial of Service. Course materials discuss DDoS mitigation strategies

highlighting the necessity of upstream filtering (scrubbing) by ISPs or specialized services to handle attacks that exceed the victim's bandwidth.

3. Mirkovic

J.

& Reiher

P. (2004). A taxonomy of DDoS attack and DDoS defense mechanisms. ACM SIGCOMM Computer Communication Review

34(2)

39–53. This foundational academic paper categorizes defense mechanisms by their deployment location

identifying filtering at the "intermediate network" (i.e.

within the ISP cloud) as a key strategy

which is the principle behind traffic scrubbing. DOI: https://doi.org/10.1145/997150.997156