Ethical Hacking Essentials Practice Test

What is a best practice to follow in order to thwart DoS/DDoS attacks?

1. Allow all inbound packets to improve connectivity

2. Block all inbound packets originating from the service ports

3. Prioritize unverified incoming traffic

4. Ignore high traffic alerts

The correct answer is: Block all inbound packets originating from the service ports

Blocking all inbound packets originating from service ports is a best practice to thwart DoS (Denial of Service) and DDoS (Distributed Denial of Service) attacks because it helps to prevent unwanted traffic from overwhelming the targeted services. Service ports are typically associated with applications that provide resources or services over the network, and attackers often target these ports with malicious traffic to exhaust resources. By blocking all inbound packets from these ports, you significantly reduce the chances of an attacker successfully flooding the service with excessive requests. This approach can help maintain the availability of legitimate services by ensuring only trusted and necessary traffic is allowed through the firewall. It also minimizes the risk of exploiting vulnerabilities in the services running on those ports. Reducing surface exposure by limiting accessible service ports can improve overall security posture, making it harder for attackers to find entry points for their attacks. This strategy contributes to the larger goal of creating a robust network defense and ensuring the system can handle legitimate traffic without being overwhelmed by attack traffic.