Which two protocols are often used for DDoS amplification attacks (choose two)

HTTP is used in application-layer (Layer 7) DDoS attacks such as HTTP floods, but it does not support the request-to-response amplification factor that characterizes amplification attacks.

TCP's three-way handshake prevents source IP spoofing from completing a connection, which removes the core mechanism needed for reflection-based amplification attacks.

DNS amplification exploits open resolvers by sending small queries (e.g., ANY record requests) that generate disproportionately large responses, which are directed at the victim's IP via source spoofing.

ICMPv6 is not commonly exploited for amplification because response sizes are not significantly larger than request sizes and most networks filter spoofed ICMP traffic.

NTP amplification abuses the monlist command, which returns a large list of recent clients from a minimal request, achieving amplification factors over 550x - making it one of the highest-amplification protocols.