Which of the following methods is an IoT portal administrator most likely to use in order to mitigate Distributed Denial of Service (DDoS) attacks?

Traffic scrubbing is a primary and highly effective method for mitigating Distributed Denial of Service (DDoS) attacks. This technique diverts all incoming traffic, including the malicious attack traffic, to a specialized third-party "scrubbing center" or an upstream Internet Service Provider (ISP) facility. At this location, the traffic is analyzed, and malicious packets are identified and dropped ("scrubbed"). Only the clean, legitimate traffic is then forwarded to the IoT portal's servers. This prevents the organization's own network perimeter and internet connection from being saturated and overwhelmed by the sheer volume of a DDoS attack, ensuring service availability for legitimate users.

A. DNSSEC authenticates DNS responses to prevent spoofing and cache poisoning; it does not mitigate volumetric traffic floods characteristic of DDoS attacks.
B. Disabling NAT-T impacts the functionality of IPsec VPNs traversing NAT devices and is not a mechanism for mitigating DDoS attacks.
D. IPSec is used to encrypt and authenticate data packets between two endpoints but does not prevent a volumetric attack from overwhelming a server's resources.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-61 Rev. 2, Computer Security Incident Handling Guide. Section 3.4.4, "Denial of Service," states that for large-scale attacks, an organization may need assistance from its ISP, which aligns with the principle of upstream traffic scrubbing. Available at: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

2. Carnegie Mellon University. (2021). 18-730: Introduction to Computer Security, Lecture 15: Network Security & Denial of Service. Course materials discuss DDoS mitigation strategies, highlighting the necessity of upstream filtering (scrubbing) by ISPs or specialized services to handle attacks that exceed the victim's bandwidth.

3. Mirkovic, J., & Reiher, P. (2004). A taxonomy of DDoS attack and DDoS defense mechanisms. ACM SIGCOMM Computer Communication Review, 34(2), 39–53. This foundational academic paper categorizes defense mechanisms by their deployment location, identifying filtering at the "intermediate network" (i.e., within the ISP cloud) as a key strategy, which is the principle behind traffic scrubbing. DOI: https://doi.org/10.1145/997150.997156