Exam CISM topic 1 question 1029 discussion

Redirect traffic to a "black hole". Blackholing involves redirecting traffic to a “black hole” or null route, which drops all traffic to the targeted IP address or range. This technique is used to prevent malicious traffic from reaching the targeted network or system during a DDoS attack.

I get the idea behind A but is says distributed denial of service (DDOS) attack. We don't know how many IPs are being utilized or the size of the attack. Therefore redirecting the attack would be simpler than trying to block each IP that we associate with the attack.

A viable containment strategy for a distributed denial of service (DDoS) attack is to D. redirect the attacker's traffic. Redirecting the attacker's traffic involves rerouting the malicious traffic away from the target servers or network infrastructure. This can be done by implementing techniques such as traffic scrubbing or utilizing specialized DDoS mitigation services. By redirecting the attacker's traffic, the impact on the targeted servers or network is minimized, allowing legitimate traffic to flow smoothly.

don't mistake containment with preventive measures. Blocking IP will prevent attack but not contain it Redirecting it contains the attack, gives you time to analyze the issue

D. Redirect the attacker's traffic makes more sense. You can redirect the unwanted traffic to a DNS sinkhole for example.

D. Redirect the attacker's traffic.