Edge and network
Absorption capacity belongs to the selected CDN, DNS or upstream network provider. Their limits and terms are part of the design.
DDoS controls
DDoS protection depends on the traffic path.
Architecture and operational controls for volumetric and application-layer denial-of-service risk.
The exposure path
Protection follows the traffic path.
Denial-of-service resilience is a chain of responsibilities. Each link has a different owner, and the weakest exposed link decides the outcome.
ZenoCloud operates
Rate limits, firewall rules, edge configuration, origin protection and the documented escalation route to upstream mitigation, where contracted.
Customer architecture
A reachable origin IP or an exhaustible application path can bypass every edge control. Architecture review closes these gaps.
During an event
Detection, triage, agreed containment steps and status communication follow the documented incident path.
Honest limitNo provider can promise protection from every attack. The design states what is covered, by whom, and what happens at each escalation point.
Common questions.
Is DDoS protection included or an add-on?
It depends on the selected controls. Some edge protections come with the platform already in the traffic path; configured rate controls, origin protection and the escalation route are part of a contracted scope. The quote states which applies.
Is a CDN enough for DDoS protection?
Only if traffic cannot bypass it and the application, origin and provider limits are understood. Architecture and operations still matter.
Can ZenoCloud absorb any attack size?
No. Capacity belongs to the selected upstream network or edge provider. ZenoCloud configures supported controls and coordinates the agreed response path.