Which two protocols are used for DDoS amplification attacks? (Choose two.)

HTTP (Hypertext Transfer Protocol) can be involved in DDoS attacks (e.g., HTTP floods), but it's generally not used for amplification in the same way DNS or NTP are, as the response size isn't inherently much larger than the request in typical scenarios.

DNS (Domain Name System) is a widely used protocol for amplification attacks. Attackers send small DNS queries to open DNS resolvers with a spoofed source IP address (the victim's), causing the resolvers to send much larger responses to the victim, amplifying traffic.

TCP (Transmission Control Protocol) is a fundamental transport protocol. While it's used in SYN floods and other DDoS attacks, TCP itself is not an application-layer protocol typically used for the amplification vector where a small request generates a much larger response.

ICMPv6 (Internet Control Message Protocol version 6) can be used for some types of floods, but it is not a primary protocol exploited for amplification attacks due to its typical response behavior not offering significant byte amplification ratios like DNS or NTP.

NTP (Network Time Protocol) is another common protocol exploited for amplification. Attackers send small NTP requests (e.g., monlist queries) to vulnerable NTP servers with a spoofed source IP, resulting in large responses being directed at the victim, causing a denial of service.