After a large influx of network traffic to externally facing devices, you begin investigating what appear to be a denial of service attack. When you review packets capture data, you notice that the…

The correct answer is D. port scanning. Sending a single SYN packet to each port is the hallmark of a port scan, not a SYN flood. A port scanner probes ports one at a time to discover which are open and what services are running - this is reconnaissance/host profiling at the port level. A SYN flood attack (A) sends a…

Threats and Vulnerabilities

Question

After a large influx of network traffic to externally facing devices, you begin investigating what appear to be a denial of service attack. When you review packets capture data, you notice that the traffic is a single SYN packet to each port. Which kind of attack is this?

Options

ASYN flood.
BHost profiling.
Ctraffic fragmentation.
Dport scanning.

How the community answered

(27 responses)

A
4% (1)
B
11% (3)
C
7% (2)
D
78% (21)

Explanation

Sending a single SYN packet to each port is the hallmark of a port scan, not a SYN flood. A port scanner probes ports one at a time to discover which are open and what services are running - this is reconnaissance/host profiling at the port level. A SYN flood attack (A) sends a massive volume of SYN packets to the same port(s) to exhaust the server's connection table via half-open TCP connections. Since the traffic here is one SYN per port across the port range, it is definitively port scanning (D). This is a common technique used before launching a targeted attack.

Topics

#port scanning#SYN scan#network reconnaissance#attack identification

Community Discussion

No community discussion yet for this question.

Full 210-250 Practice