Which statement about border firewalls and TCP flag-based DoS attacks is accurate?

• A. They can stop such attacks.
• B. They cannot stop such attacks.
• C. They require antivirus software.
• D. They are irrelevant to these attacks.

Answer: (A)

Border firewalls at the network edge control what enters the internal network by inspecting packet headers, including TCP flags, and applying rules to drop or rate-limit suspicious traffic. A TCP flag-based DoS attack relies on crafting packets with unusual or conflicting flag combinations to tie up server resources or bypass simple filters. When a firewall is properly configured with stateful inspection and tailored rules, it can recognize these anomalous flag patterns, drop the offending packets, and throttle the flood so legitimate traffic can still get through. Features like SYN cookies help defend against SYN floods, further reducing resource exhaustion on the target.

So, at the border, these protections are designed to detect and mitigate such attacks before they reach internal hosts, which is why this statement is best. Antivirus software isn’t the primary defense against network floods, as it targets malware on hosts rather than malicious network traffic, and saying they’re irrelevant overlooks the firewall’s role in filtering at the edge.