Refer to the exhibit. An engineer must troubleshoot an incident by using Cisco Secure Cloud Analytics. What is the cause of the issue?

Question

Exhibit

Options

• ASYN flood attack toward the DNS server that has IP address 10.10.10.10
• BDoS attack toward the 50.10.10.0/24 network from an internal IP address
• CPing of Death attack toward the host that has IP address 10.10.10.10
• DTCP fingerprinting toward the 50.10.10.0/24 network

• A
  58% (21)
• B
  14% (5)
• C
  6% (2)
• D
  22% (8)

Explanation

Option A is correct because Cisco Secure Cloud Analytics would display a high volume of TCP SYN packets destined for 10.10.10.10 on port 53 (DNS) without corresponding SYN-ACK completions, which is the hallmark of a SYN flood - an attacker overwhelms the target's TCP connection table by never completing the three-way handshake.

Why the distractors are wrong:

• B is wrong because the traffic direction is reversed - the exhibit shows the attack targeting 10.10.10.10, not originating from an internal host toward the 50.10.10.0/24 network.
• C is wrong because a Ping of Death uses oversized ICMP packets, not TCP SYN segments; Secure Cloud Analytics would show anomalous ICMP traffic, not half-open TCP connections.
• D is wrong because TCP fingerprinting (OS detection) involves sending small crafted probe packets for reconnaissance - it produces a completely different traffic pattern and is not an attack against a DNS server.

Memory tip: Think "SYN flood = DNS + no handshake completion." When you see massive one-sided TCP SYN traffic toward port 53 (DNS) in Secure Cloud Analytics with no ACKs returning, that's your SYN flood signature - the attacker is deliberately leaving connections half-open to exhaust server resources.

No community discussion yet for this question.