In the context of mitigating DDoS, which option would help reduce broadcast-based amplification?

In the context of mitigating DDoS, which option would help reduce broadcast-based amplification?

• A. Enable direct broadcasts
• B. Disable direct broadcasts
• C. Enable BGP
• D. Disable BGP

Answer: (B)

Broadcast-based amplification happens when an attacker leverages a network’s broadcast addresses to trigger many devices to respond to the target, overwhelming it with traffic (a pattern seen in smurf-like attacks). The effective defense is to stop routers from forwarding packets to broadcast addresses. By disabling directed (direct) broadcasts, you remove the channel that allows that amplification, so the attack traffic cannot be amplified through broadcast domains. Enabling direct broadcasts would reopen that amplification path, making the attack possible again. BGP is a routing protocol and does not directly mitigate broadcast-based amplification, so enabling or disabling it won’t address the underlying broadcast misuse.

Broadcast-based amplification happens when an attacker leverages a network’s broadcast addresses to trigger many devices to respond to the target, overwhelming it with traffic (a pattern seen in smurf-like attacks). The effective defense is to stop routers from forwarding packets to broadcast addresses. By disabling directed (direct) broadcasts, you remove the channel that allows that amplification, so the attack traffic cannot be amplified through broadcast domains.

Enabling direct broadcasts would reopen that amplification path, making the attack possible again. BGP is a routing protocol and does not directly mitigate broadcast-based amplification, so enabling or disabling it won’t address the underlying broadcast misuse.