200-201 · Question #368
After a large influx of network traffic to externally facing devices, a security engineer begins investigating what appears to be a denial of service attack. When the packet capture data is…
The correct answer is D. SYN flood. The attack described, characterized by a large influx of traffic consisting of a single SYN packet to each port, indicates a SYN flood attack aimed at causing a denial of service.
Question
After a large influx of network traffic to externally facing devices, a security engineer begins investigating what appears to be a denial of service attack. When the packet capture data is reviewed, the engineer notices that the traffic is a single SYN packet to each port. Which type of attack is occurring?
Options
- Atraffic fragmentation
- Bport scanning
- Chost profiling
- DSYN flood
How the community answered
(64 responses)- A25% (16)
- B13% (8)
- C8% (5)
- D55% (35)
Why each option
The attack described, characterized by a large influx of traffic consisting of a single SYN packet to each port, indicates a SYN flood attack aimed at causing a denial of service.
Traffic fragmentation involves breaking up packets into smaller pieces to bypass security controls, which is not described here.
Port scanning involves probing ports to discover open services, but a 'large influx of traffic' with 'a single SYN packet to each port' strongly suggests an attempt to overwhelm resources rather than just discovery, making SYN flood more precise in the context of a DoS attack.
Host profiling involves gathering information about a target system (e.g., OS, services) which may include scanning but is not the direct attack described.
A SYN flood attack involves sending a high volume of TCP SYN packets to a target system but never completing the three-way handshake, leading the target to keep many half-open connections, exhausting its resources and causing a denial of service.
Concept tested: SYN flood attack identification
Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/ddos-best-practices
Topics
Community Discussion
No community discussion yet for this question.