Which components are commonly involved in a layered DDoS mitigation strategy?

Which components are commonly involved in a layered DDoS mitigation strategy?

• A. Only increasing bandwidth without filtering.
• B. Traffic filtering and rate limiting, scrubbing centers, anycast, load balancing, scalable bandwidth, and anomaly detection.
• C. Isolating the network from the Internet entirely.
• D. Relying solely on a firewall to stop all attacks.

Answer: (B)

A layered DDoS mitigation strategy relies on defense-in-depth: combining multiple, complementary controls so an attack is stopped or weakened at several points rather than relying on a single measure. Traffic filtering and rate limiting sit at the edge to drop or throttle suspicious or excessive requests, letting legitimate traffic through and reducing the load on downstream defenses. Scrubbing centers take in large volumes of traffic and clean it, sending only clean traffic toward the target so malicious packets never reach the services. Anycast distributes traffic across many geographically dispersed locations, so a flood is spread out and no single site becomes a bottleneck. Load balancing further spreads demand across multiple servers or paths, preventing overload on any single resource. Scalable bandwidth provides the capacity to absorb unusually large floods, buying time for other defenses to react, while anomaly detection monitors traffic for unusual patterns and triggers automated or manual responses when an attack is detected. Together, these layers form a robust defense because each component addresses different attack vectors and scales with the threat, maintaining service availability even under heavy, coordinated traffic. Relying only on increasing bandwidth or isolating the network, or using a firewall alone, leaves gaps—either the attack overwhelms without filtration, connectivity is unusably cut off, or the protection is insufficient against large, distributed floods.

A layered DDoS mitigation strategy relies on defense-in-depth: combining multiple, complementary controls so an attack is stopped or weakened at several points rather than relying on a single measure.

Traffic filtering and rate limiting sit at the edge to drop or throttle suspicious or excessive requests, letting legitimate traffic through and reducing the load on downstream defenses. Scrubbing centers take in large volumes of traffic and clean it, sending only clean traffic toward the target so malicious packets never reach the services. Anycast distributes traffic across many geographically dispersed locations, so a flood is spread out and no single site becomes a bottleneck. Load balancing further spreads demand across multiple servers or paths, preventing overload on any single resource. Scalable bandwidth provides the capacity to absorb unusually large floods, buying time for other defenses to react, while anomaly detection monitors traffic for unusual patterns and triggers automated or manual responses when an attack is detected.

Together, these layers form a robust defense because each component addresses different attack vectors and scales with the threat, maintaining service availability even under heavy, coordinated traffic. Relying only on increasing bandwidth or isolating the network, or using a firewall alone, leaves gaps—either the attack overwhelms without filtration, connectivity is unusably cut off, or the protection is insufficient against large, distributed floods.