Explain how you would protect an organization against DDoS attacks.
Interview preparation resource from Gate Smashers.
I would use a layered DDoS-defense strategy that combines upstream mitigation, distributed edge capacity, application controls, resilient infrastructure, and an exercised incident-response plan. The key principle is to stop traffic as far from the origin as possible: if a volumetric attack saturates the organization’s Internet link, an on-premises firewall cannot restore that lost bandwidth. Large attacks therefore require ISP, cloud, or dedicated scrubbing protection upstream of the organization. At the network and edge layers, I would use a DDoS-protection provider, CDN, reverse proxy, or Anycast-based edge where appropriate. These services absorb and filter high-volume traffic before forwarding legitimate requests to protected origins. I would also restrict direct access to origin systems so that attackers cannot bypass the edge. For state-exhaustion and application-layer attacks, I would apply connection and request rate limits at suitable points such as load balancers, API gateways, firewalls, and applications. A WAF and bot-management controls can identify malformed requests, abusive automation, suspicious request patterns, and attacks against expensive application endpoints. Limits should be designed carefully so legitimate traffic is not unnecessarily blocked. I would build resilience through redundant Internet connectivity where justified, protected and redundant authoritative DNS, multiple load balancers, and capacity distributed across failure domains. Network ACLs and source-address validation, where under organizational or provider control, can reduce unwanted and spoofed traffic. Finally, I would continuously monitor bandwidth, flow data, connection counts, request rates, latency, error rates, and resource utilization. A tested DDoS runbook should define detection thresholds, ownership, escalation paths, provider contacts, mitigation actions, communications, and recovery steps. Regular testing ensures the technical controls and operational response work together during an actual attack.
Defense strategy and attack layers
DDoS attacks may exhaust Internet bandwidth, network-device or server connection state, or application resources. Effective protection is therefore layered rather than dependent on a single firewall or appliance.
Volumetric attacks must be mitigated before they saturate the organization’s Internet connection. Once the link is full, local systems may remain reachable internally but external users cannot reach them.
Upstream and edge mitigation
Use ISP, cloud, or dedicated traffic-scrubbing services to detect and filter large attack traffic upstream. A CDN, reverse proxy, or distributed edge network can absorb traffic across a larger footprint and forward only permitted traffic toward the origin.
Protect origin infrastructure from direct exposure. Public services should be reachable through the intended protected entry points, while origin access is limited to necessary sources and paths.
- Upstream filtering: Removes volumetric attack traffic before it consumes the organization’s access bandwidth.
- Distributed edge: Distributes public traffic across multiple edge locations and reduces dependence on a single origin-facing connection or site.
Connection and application-layer controls
Apply rate limits and connection controls at the layers that can enforce them effectively, such as load balancers, API gateways, firewalls, and application servers. Controls should protect scarce resources, especially endpoints that trigger expensive processing.
Use application-aware defenses for HTTP(S) attacks. A WAF and bot-management capabilities can enforce request validation and identify abusive automation or suspicious behavior. Policies require tuning to avoid blocking legitimate users during traffic spikes.
- Rate and connection limits: Constrain unusually high request rates, concurrent connections, and repeated access to sensitive endpoints.
- WAF and bot controls: Help mitigate malicious HTTP requests and automated abuse using application-aware rules and signals.
Resilience, monitoring, and response
Remove avoidable single points of failure through suitable redundancy in connectivity, load balancing, service capacity, and authoritative DNS. Use network filtering and source-address validation where the organization or its providers control those networks.
Monitor network traffic and service health continuously so attacks can be identified quickly. Maintain and regularly test a DDoS runbook that coordinates technical mitigation with provider escalation, internal responsibilities, communications, and recovery.
- Monitor: Track bandwidth, traffic flows, connection counts, request rates, latency, error rates, and resource utilization.
- Prepare: Document escalation contacts, thresholds, mitigation procedures, decision ownership, and recovery actions.