Question 1100

The Polite Flood

Traffic to your product search endpoint climbs to 9,000 requests per second. Every request is a complete TLS session with a plausible browser User-Agent, each query string carries a different random parameter, CDN cache hit ratio has fallen from 94% to 3%, and origin database CPU sits at 100%. Bandwidth is unremarkable. What is happening, and what is the best first move?

A

A slow-request attack in the style of Slowloris, so shorten the header and body read timeouts, cap concurrent connections per source address, and enforce a minimum byte rate on each connection

B

A cache-busting application-layer flood: random parameters miss the cache key, so normalize the key at the edge to drop unknown parameters and rate limit by client fingerprint

C

A volumetric flood the CDN is passing straight through, so ask the transit provider to null route the destination prefix until the botnet's sources give up

D

A TLS renegotiation attack that inflates handshake cost on the origin, so disable session resumption and require a fresh full handshake on every connection