nerdexam
EC-Council

312-50V12 · Question #167

An audacious attacker is targeting a web server you oversee. He intends to perform a Slow HTTP POST attack, by manipulating 'a' HTTP connection. Each connection sends a byte of data every 'b'…

The correct answer is A. m=90, b=15: The server can manage 90 connections per second, but the attacker's 100. This question asks to identify the scenario that would result in the longest server unavailability during a Slow HTTP POST attack, which aims to overwhelm a server by holding connections open for extended periods.

Submitted by yuriko_h· Mar 4, 2026Web Application Hacking

Question

An audacious attacker is targeting a web server you oversee. He intends to perform a Slow HTTP POST attack, by manipulating 'a' HTTP connection. Each connection sends a byte of data every 'b' second, effectively holding up the connections for an extended period. Your server is designed to manage 'm' connections per second, but any connections exceeding this number tend to overwhelm the system. Given 'a=100' and variable 'm', along with the attacker's intention of maximizing the attack duration 'D=a*b', consider the following scenarios. Which is most likely to result in the longest duration of server unavailability?

Options

  • Am=90, b=15: The server can manage 90 connections per second, but the attacker's 100
  • Bm=105, b=12: The server can manage 105 connections per second, more than the attacker's 100
  • Cm=110, b=20: Despite the attacker sending 100 connections, the server can handle 110
  • Dm=95, b=10: Here, the server can handle 95 connections per second, but it falls short against the

How the community answered

(35 responses)
  • A
    66% (23)
  • B
    20% (7)
  • C
    11% (4)
  • D
    3% (1)

Why each option

This question asks to identify the scenario that would result in the longest server unavailability during a Slow HTTP POST attack, which aims to overwhelm a server by holding connections open for extended periods.

Am=90, b=15: The server can manage 90 connections per second, but the attacker's 100Correct

In scenario A, the attacker's 100 connections exceed the server's capacity of 90 connections per second (100 > 90), causing the server to become overwhelmed and unavailable. With a 'b' value of 15 seconds, this creates the longest attack duration (D = 100 * 15 = 1500 seconds) among the choices where the server is actually overwhelmed, thus maximizing the period of unavailability.

Bm=105, b=12: The server can manage 105 connections per second, more than the attacker's 100

Scenario B involves a server capacity of 105 connections, which is greater than the attacker's 100 connections (105 > 100), meaning the server is not overwhelmed and significant unavailability is less likely.

Cm=110, b=20: Despite the attacker sending 100 connections, the server can handle 110

In scenario C, the server's capacity of 110 connections per second exceeds the attacker's 100 connections (110 > 100), preventing the server from being overwhelmed and thus minimizing service unavailability, despite having the largest 'b' value.

Dm=95, b=10: Here, the server can handle 95 connections per second, but it falls short against the

Although the server in scenario D is overwhelmed by the 100 attacker connections as it can only manage 95 (100 > 95), its 'b' value of 10 seconds results in a shorter attack duration (D = 100 * 10 = 1000 seconds) compared to scenario A, leading to a shorter period of unavailability.

Concept tested: Slow HTTP POST attack impact and server capacity

Source: https://learn.microsoft.com/en-us/azure/architecture/framework/resiliency/failure-mode-analysis#slowloris-attack

Topics

#Slow HTTP POST#DoS attacks#web server attacks#resource exhaustion

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice