All DDoS Definitions
DDoS Testing Definition

Challenge-Response

A challenge-response mechanism is a Layer 7 defensive control, one of the protections a thorough DDoS test is built to exercise. When a request looks suspicious, the edge interposes a test the client must pass before traffic reaches the origin: a JavaScript computation, a managed CAPTCHA, or a proof-of-work puzzle. Automated clients that cannot execute the challenge are filtered, while real browsers solve it transparently or with one interaction.

Challenge-response: a test the client must pass Suspicious request at edge Challenge interposed before the origin is reached JS computation managed CAPTCHA proof-of-work puzzle solved fails Real browser solves, reaches origin Automated client cannot solve, filtered A headless client can clear the challenge, and a trigger that fires after saturation is already too late. A test measures whether scripted clients clear the challenge, the latency it adds for real users, and if it fires in time. BlackNeuron™
Challenge-response interposes a test at the edge: a real browser solves it and reaches the origin, while an automated client that cannot solve it is filtered out

Why it matters in DDoS testing

Challenge-response shifts cost back onto the attacker, but it has sharp edges. A test measures whether headless or scripted clients clear the challenge anyway, the latency and conversion penalty the challenge imposes on legitimate users, and whether the trigger threshold fires early enough to matter during a fast L7 flood. A challenge that only engages after the origin is already saturated provides little protection.

For the application-layer attacks this control targets, see understanding DDoS attack vectors.