DDoS protection strategies in HLD - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Basic DDoS Mitigation Techniques

Which of the following is the most effective initial step to mitigate a volumetric DDoS attack targeting a web service?

A Deploy a Web Application Firewall (WAF) to filter malicious HTTP requests.

B Use rate limiting at the network edge to restrict excessive traffic from single IPs.

C Increase server CPU and memory resources to handle more requests.

D Implement database query caching to reduce load on the backend.

💡 Hint

Think about stopping traffic before it reaches the server.

Rate limiting at the network edge helps block excessive traffic early, reducing the attack impact. WAFs help but are more effective for application-layer attacks. Increasing resources doesn't stop the attack, only delays failure. Caching helps backend load but not network flood.

❓ Architecture

intermediate

Designing a Scalable DDoS Protection Architecture

You need to design a system to protect a global web application from DDoS attacks. Which architectural component is essential to distribute and absorb large attack traffic?

A A centralized firewall cluster located in the main data center.

B A single load balancer with auto-scaling backend servers.

C A global Content Delivery Network (CDN) with edge caching and traffic scrubbing.

D A database replica cluster to handle increased read queries.

💡 Hint

Consider spreading traffic geographically to reduce attack impact.

A global CDN distributes traffic across many edge locations, absorbing and filtering attack traffic closer to the source. Centralized firewalls and single load balancers become bottlenecks. Database replicas help backend but don't mitigate network floods.

❓ scaling

advanced

Capacity Planning for DDoS Protection

Your service expects a peak legitimate traffic of 10,000 requests per second (RPS). To handle potential DDoS attacks, you want to provision protection capacity to absorb 10x that traffic. What is the minimum network bandwidth capacity you should plan for, assuming each request averages 500 bytes?

A Approximately 40 Gbps

B Approximately 4 Gbps

C Approximately 40 Mbps

D Approximately 400 Mbps

💡 Hint

Calculate total bytes per second for 100,000 RPS and convert to bits per second.

100,000 RPS * 500 bytes = 50,000,000 bytes/sec = 400,000,000 bits/sec = 400 Mbps. This capacity ensures absorbing 10x peak legitimate traffic.

❓ tradeoff

advanced

Tradeoffs in Using Cloud-Based DDoS Protection Services

Which is the main tradeoff when relying on a third-party cloud DDoS protection service?

A You must trust the provider with your traffic data and routing.

B You have to rewrite your application to use the service APIs.

C You lose control over your server hardware specifications.

D You cannot scale your backend application independently.

💡 Hint

Think about privacy and control over data flow.

Using cloud DDoS protection means routing your traffic through the provider, which requires trusting them with your data and traffic patterns. Hardware specs and application scaling remain your responsibility. Application code changes are usually minimal or none.

❓ component

expert

Identifying the Bottleneck in a DDoS Protection Pipeline

Consider a DDoS protection pipeline with these components in order: Network Firewall → Traffic Analyzer → Rate Limiter → Load Balancer → Application Servers. During a large attack, which component is most likely to become the bottleneck and why?

A Traffic Analyzer, because deep packet inspection is CPU intensive and can delay traffic.

B Network Firewall, because it inspects all packets and may have limited throughput.

C Rate Limiter, because it maintains state for many IPs and can exhaust memory.

D Load Balancer, because it distributes traffic unevenly causing server overload.

💡 Hint

Consider which step requires the most complex processing per packet.

Traffic Analyzer often performs deep inspection and behavioral analysis, which is CPU intensive and can slow down traffic flow under heavy load. Firewalls are optimized for throughput, rate limiters use efficient data structures, and load balancers distribute load but rarely become bottlenecks first.

Practice

1. Which of the following is a primary goal of DDoS protection strategies?

easy

A. Keep the service available during attack

B. Increase the number of incoming requests

C. Slow down legitimate user traffic

D. Disable firewalls to allow all traffic

Solution

1. Step 1: Understand the purpose of DDoS protection

   DDoS protection aims to prevent attacks from making a service unavailable by handling malicious traffic.

2. Step 2: Evaluate each option against this purpose

   Increasing requests or slowing legitimate traffic harms availability. Disabling firewalls reduces security. Only keeping service available matches the goal.

3. Final Answer:

   Keep the service available during attack -> Option A

4. Quick Check:

   DDoS protection = Keep service available [OK]

Hint: DDoS protection means keeping service up, not blocking all traffic [OK]

Common Mistakes:

• Confusing DDoS protection with traffic blocking
• Thinking DDoS protection increases traffic
• Assuming firewalls should be disabled during attacks

2. Which component is commonly used to distribute incoming traffic and help mitigate DDoS attacks?

easy

A. Load balancer

B. Cache server

C. Database server

D. Application server

Solution

1. Step 1: Identify components that manage traffic

   Load balancers distribute incoming requests across multiple servers to prevent overload.

2. Step 2: Match component to DDoS mitigation role

   Load balancers help absorb and spread traffic, reducing attack impact. Other options do not distribute traffic.

3. Final Answer:

   Load balancer -> Option A

4. Quick Check:

   Traffic distribution = Load balancer [OK]

Hint: Load balancers spread traffic to avoid overload [OK]

Common Mistakes:

• Confusing cache or database servers as traffic distributors
• Thinking application servers handle traffic distribution
• Ignoring the role of load balancers in DDoS defense

3. Consider a system using a CDN and a firewall with rate limiting. Which of the following best describes the request flow during a DDoS attack?

medium

A. Requests go directly to the origin server, bypassing CDN and firewall

B. CDN absorbs traffic, firewall filters requests, then origin server processes allowed requests

C. Firewall blocks all requests, CDN caches nothing

D. Origin server handles all requests before CDN and firewall

Solution

1. Step 1: Understand CDN and firewall roles

   CDNs cache content and absorb traffic near users. Firewalls filter malicious requests before reaching origin.

2. Step 2: Trace request flow during attack

   Requests first hit CDN, which reduces load. Firewall then filters suspicious traffic. Only allowed requests reach origin server.

3. Final Answer:

   CDN absorbs traffic, firewall filters requests, then origin server processes allowed requests -> Option B

4. Quick Check:

   Request flow = CDN -> Firewall -> Origin [OK]

Hint: Traffic flows CDN -> Firewall -> Origin server during attack [OK]

Common Mistakes:

• Assuming requests bypass CDN or firewall
• Thinking firewall blocks all requests indiscriminately
• Believing origin server handles all traffic first

4. A system uses IP blacklisting to block attackers, but legitimate users are still affected. What is the likely issue?

medium

A. Firewall is disabled

B. Blacklist is empty, no IPs blocked

C. Blacklist is too broad, blocking shared IPs

D. System does not log blocked IPs

Solution

1. Step 1: Analyze impact of IP blacklisting

   Blacklisting blocks specific IPs. If too broad, it may block IPs shared by many users.

2. Step 2: Identify why legitimate users are affected

   Blocking shared IPs causes collateral damage to good users. Other options do not explain this effect.

3. Final Answer:

   Blacklist is too broad, blocking shared IPs -> Option C

4. Quick Check:

   Legitimate users blocked = Broad blacklist [OK]

Hint: Too broad blacklist blocks good users too [OK]

Common Mistakes:

• Assuming empty blacklist blocks users
• Ignoring shared IP usage in blacklisting
• Thinking firewall status causes this issue

5. You design a DDoS protection system combining CDN, rate limiting, and real-time traffic analysis. Which approach best balances user experience and attack mitigation?

hard

A. Apply strict rate limits globally, blocking many users during spikes

B. Allow all traffic and rely on origin server capacity

C. Disable CDN and rely only on manual IP blocking

D. Use CDN to absorb traffic, apply adaptive rate limits based on analysis, and alert admins on anomalies

Solution

1. Step 1: Evaluate each strategy's impact on users and attack defense

   Strict global limits block many users, hurting experience. Disabling CDN or manual blocking is slow and risky.

2. Step 2: Identify balanced approach

   Using CDN to absorb traffic reduces load. Adaptive rate limits adjust to traffic patterns, minimizing false blocks. Real-time alerts enable quick response.

3. Final Answer:

   Use CDN to absorb traffic, apply adaptive rate limits based on analysis, and alert admins on anomalies -> Option D

4. Quick Check:

   Balanced DDoS defense = CDN + adaptive limits + alerts [OK]

Hint: Combine CDN, adaptive limits, and alerts for best balance [OK]

Common Mistakes:

• Applying strict limits without adaptation
• Ignoring CDN benefits
• Relying only on manual blocking or server capacity