Exam PT0-002 topic 1 question 350 discussion

Using multiple IPs may bypass basic IP-based blocking, but it does not bypass the WAF itself, which still inspects traffic for malicious patterns. The API may not be being DOS'ed, it could just be being exploited, in that case the WAF will still block all exploit attempts no matter what IP it comes from. Direct to origin attack will "best ensure the attacks will be more successful"

Gemini says D

Silly question, as usual. DDoS mitigation often uses an architecture in which a CDN or large reverse proxies are placed in front of the web services as a protection layer. However, sophisticated attackers will attempt to reveal the origin network or IP address and attack directly, making the mitigation layer completely useless. This attack is called ‘Direct-to-Origin’ or in short ‘D2O‘. This attack technique challenges organizations to either hide their sources (which is not always feasible), or mitigate the direct attack. The DDoS Resiliency Score (DRS) include this technique in attack vectors launched specified in ‘Level 6’ and ‘Level 7’. Imo there are not enough elements to think of a Direct-to-origin attacks, so i vote for C.

D. Locate the company's servers that are hosting the API and send the traffic there. Explanation: Bypassing the WAF by directly targeting the servers hosting the API avoids the issue of dealing with the filtering and inspection that the WAF provides. This option represents a more advanced technique where the attacker seeks to send traffic to a backend system, avoiding the WAF entirely. Why not C: Multiple source IP addresses (Option C) could work against simpler WAF configurations, but modern, sophisticated WAFs can detect distributed attacks and block such traffic, as highlighted by both comments.

Modern WAFs are indeed capable of detecting distributed attacks coming from multiple IPs. However, D assumes a high level of infrastructure visibility that is not mentioned in the question.

Answer is D. Answer can't be C. Using multiple source IP addresses for the attack traffic to prevent being blocked: While this might help in evading basic rate limiting or IP-based blocking, sophisticated WAFs can detect and block such techniques. It doesn’t address the core issue of the WAF filtering and inspecting traffic.