Certified Ethical Hacker (CEH) Practice Question

Reflection and amplification attacks depend on the ability of an attacker to spoof the victim's IP address in small UDP requests sent to misconfigured public services such as NTP, DNS, or memcached. The compromised servers then send much larger replies to the spoofed address, flooding the victim. Enforcing BCP 38/ingress-egress filtering at the edge router-dropping any outbound packet whose source IP address does not belong to the organization's own prefixes-removes the attacker's ability to spoof other networks' addresses, so the servers can no longer serve as reflectors. Reducing MTU only limits packet size but not spoofing, SYN cookies mitigate SYN floods (a different DoS vector), and blocking inbound ICMP echoes defends against classic Smurf attacks but leaves UDP-based reflection channels untouched.