An organisation's 1 Gbit/s link to its ISP is completely saturated by a flood. Where must filtering be installed for legitimate traffic to get through again?

Answer

Upstream, in the ISP's network

Options - A. Upstream, in the ISP's network - B. On the organisation's boundary router - C. On each targeted server, using host firewall rules - D. In the application, behind a CAPTCHA Why - A. Correct — the saturated resource is the link itself, so the only place a filter helps is on the far side of it, where the ISP still has capacity to spare. - B. The classic wrong answer. The boundary router sits behind the saturated link: by the time it sees a packet, that packet has already consumed the bandwidth that was the target. - C. Same problem one hop further in, and worse — the server never sees most of the traffic, because the link discarded it. - D. A CAPTCHA answers an application-resource attack, where the requests are valid but expensive. It does nothing about raw bandwidth exhaustion. Match the defence to the resource. Ask "what ran out?" and then "where is that thing?" — the filter goes upstream of the answer.

Stallings & Brown, Computer Security 5e, ch7 §7.6–§7.7; RFC 2827 (BCP 38) for ingress filtering