DDoS Protection - Interview Questions & Answers

A Distributed Denial of Service (DDoS) attack is one of the most common cyber attacks targeting internet-facing applications. The objective is to overwhelm a server, API, or network with massive traffic, making legitimate services unavailable.

Enterprise applications use multiple protection layers including CDNs, Web Application Firewalls (WAF), Rate Limiting, Load Balancers, Auto Scaling, and DDoS Protection Services to mitigate these attacks.

---

Q1. What is a DDoS attack?

Answer

A Distributed Denial of Service (DDoS) attack occurs when multiple compromised devices send enormous amounts of traffic to a target server, exhausting its resources.

The goal is to:

• Make applications unavailable
• Consume bandwidth
• Exhaust CPU and memory
• Prevent legitimate users from accessing services

DDoS Attack

flowchart LR
A[Bot 1] --> D[Target Server]

B[Bot 2] --> D

C[Bot 3] --> D

E[Bot 10000+] --> D

---

Q2. What is the difference between DoS and DDoS?

Answer

DoS	DDoS
Single attacker	Multiple attackers
Easier to detect	Harder to detect
Lower traffic volume	Massive distributed traffic
Less sophisticated	Highly sophisticated

Comparison

flowchart TD
A[DoS] --> B[Single Machine]

C[DDoS] --> D[Thousands of Bots]

Interview Tip

A DDoS attack typically originates from a botnet, making it much harder to block using simple IP filtering.

---

Q3. How does a DDoS attack work?

Answer

Attackers first compromise thousands of devices and build a botnet.

The botnet simultaneously sends requests to the victim.

DDoS Flow

flowchart TD
A[Attacker] --> B[Botnet]

B --> C[Bot 1]

B --> D[Bot 2]

B --> E[Bot 3]

C --> F[Target]

D --> F

E --> F

Result

• Server overload
• Slow response
• Application outage

---

Q4. What are the different types of DDoS attacks?

Answer

The three major categories are:

Attack Type	Target
Volumetric	Network Bandwidth
Protocol	Network Infrastructure
Application Layer	Web Applications & APIs

Categories

flowchart TD
A[DDoS]

A --> B[Volumetric]

A --> C[Protocol]

A --> D[Application Layer]

Examples

• UDP Flood
• SYN Flood
• HTTP Flood
• DNS Amplification

---

Q5. How can DDoS attacks be detected?

Answer

Common indicators include:

• Sudden traffic spikes
• High CPU usage
• Increased latency
• Large number of requests from multiple IPs
• Increased error rates
• Bandwidth exhaustion

Detection Flow

flowchart TD
A[Incoming Traffic] --> B[Traffic Monitoring] --> C{Abnormal Spike?}

C -->|Yes| D[DDoS Alert]

C -->|No| E[Normal Traffic]

---

Q6. How can applications be protected from DDoS attacks?

Answer

Protection requires multiple security layers.

DDoS Protection Architecture

flowchart TD
A[Internet] --> B[CDN] --> C[DDoS Protection] --> D[Web Application Firewall] --> E[Load Balancer] --> F[API Gateway] --> G[Spring Boot Application]

Protection Techniques

• CDN
• WAF
• Rate Limiting
• Auto Scaling
• Traffic Filtering
• Load Balancing

---

Q7. What is Rate Limiting and how does it help?

Answer

Rate Limiting restricts how many requests a client can make within a given time period.

Example:

100 Requests / Minute

Requests beyond the limit receive HTTP 429 Too Many Requests.

Rate Limiting

flowchart TD
A[Incoming Requests] --> B[Rate Limiter] --> C{Within Limit?}

C -->|Yes| D[Application]

C -->|No| E[429 Too Many Requests]

Benefits

• Prevents abuse
• Protects APIs
• Reduces server load

---

Q8. What cloud services provide DDoS protection?

Answer

Popular enterprise services include:

• AWS Shield
• AWS Shield Advanced
• Azure DDoS Protection
• Google Cloud Armor
• Cloudflare
• Akamai
• Imperva

Cloud Protection

flowchart TD
A[DDoS Protection]

A --> B[AWS Shield]

A --> C[Cloudflare]

A --> D[Azure DDoS]

A --> E[Google Cloud Armor]

---

Q9. What are common mistakes when designing DDoS protection?

Answer

Common mistakes include:

• No CDN
• No Rate Limiting
• Public database exposure
• Missing WAF
• No Auto Scaling
• No traffic monitoring
• Single server deployment
• No alerting

Wrong Design

Internet

↓

Application ❌

Correct Design

Internet

↓

CDN

↓

DDoS Protection

↓

WAF

↓

Load Balancer

↓

Application ✅

---

Q10. What are the enterprise best practices for DDoS protection?

Answer

Follow these best practices:

• Use CDN for global traffic distribution.
• Enable cloud-native DDoS protection.
• Deploy Web Application Firewall (WAF).
• Configure Rate Limiting.
• Use Auto Scaling.
• Monitor traffic continuously.
• Enable alerting.
• Protect APIs using API Gateway.
• Block malicious IPs when appropriate.
• Regularly perform resilience testing.

Enterprise Architecture

flowchart TD
A[Users] --> B[CDN] --> C[DDoS Protection] --> D[Firewall] --> E[WAF] --> F[Load Balancer] --> G[API Gateway] --> H[Spring Boot Microservices] --> I[Database]

Defense in Depth

flowchart LR
A[CDN] --> B[DDoS Protection] --> C[Firewall] --> D[WAF] --> E[Rate Limiting] --> F[Application]

DDoS Protection Checklist

mindmap
  root((DDoS Protection))
    CDN
    AWS Shield
    WAF
    Rate Limiting
    Load Balancer
    Auto Scaling
    Monitoring
    Alerting
    API Gateway
    Traffic Analysis

Senior Interview Tip

There is no single technology that completely prevents DDoS attacks.

A production-ready enterprise architecture combines:

• CDN
• Cloud-native DDoS protection (AWS Shield, Azure DDoS Protection, Google Cloud Armor)
• Firewall
• Web Application Firewall (WAF)
• Rate Limiting
• API Gateway
• Load Balancer
• Auto Scaling
• Continuous Monitoring
• SIEM and Alerting

Large organizations also perform regular load testing and resilience testing to validate that critical applications can withstand high traffic volumes.

---

Quick Revision

• DDoS attacks use many compromised devices to overwhelm a target.
• DoS involves a single attacker; DDoS involves distributed sources.
• DDoS attacks can target bandwidth, protocols, or applications.
• Monitor traffic to detect abnormal spikes.
• Use CDN and cloud DDoS protection services.
• Enable WAF and Rate Limiting.
• Deploy Load Balancers and Auto Scaling.
• Monitor traffic continuously and configure alerts.
• Protect APIs using API Gateways.
• Apply Defense in Depth to minimize the impact of DDoS attacks.