312-50V13 · Question #543
Your network infrastructure is under a SYN flood attack. The attacker has crafted an automated botnet to simultaneously send 's' SYN packets per second to the server. You have put measures in place to
The correct answer is D. f=420: The server can handle 490 SYN packets per second. With 's' exceeding `f by 10, the. Explanation Option D is correct because with f=420, the server can only handle 420 SYN packets per second, meaning the attacker's 500 SYN packets per second exceeds the server's capacity by 80 packets (k=80), resulting in a response time increase of 2⁴⁽⁸⁰⁾ - an astronomically lar
Question
f' SYN packets per second, and the system is designed to deal with this number without any performance issues. If 's' exceeds f', the network infrastructure begins to show signs of overload. The system's response time increases exponentially (24k), where 'k' represents each additional SYN packet above the ff limit. Now, considering 's=500' and different 'f values, in which scenario is the server most likely to experience overload and significantly increased response times?Options
- Af=510: The server can handle 510 SYN packets per second, which is greater than what the
- Bf=495: The server can handle 495 SYN packets per second. The response time drastically rises
- Cf=S05: The server can handle 505 SYN packets per second. In this case, the response time
- Df=420: The server can handle 490 SYN packets per second. With 's' exceeding `f by 10, the
How the community answered
(57 responses)- A11% (6)
- B5% (3)
- C2% (1)
- D82% (47)
Explanation
Explanation
Option D is correct because with f=420, the server can only handle 420 SYN packets per second, meaning the attacker's 500 SYN packets per second exceeds the server's capacity by 80 packets (k=80), resulting in a response time increase of 2⁴⁽⁸⁰⁾ - an astronomically large value representing catastrophic overload. Options A (f=510) and C (f=505) are wrong because both values exceed s=500, meaning the server can handle the incoming traffic without any overload occurring. Option B (f=495) does cause overload with k=5, giving a response time of 2⁴⁽⁵⁾ = 2²⁰, which is significant but far smaller than the 2⁴⁽⁸⁰⁾ produced in option D, making D the scenario with the most severe overload and increased response times. Note that option D's description contains a discrepancy (stating f=490 instead of f=420), but the key principle remains that the largest gap between s and f produces the most extreme exponential penalty.
Memory Tip: Think of it as a "bigger gap = bigger pain" rule - since response time grows exponentially with each extra packet, the scenario where f is furthest below s will always produce the most devastating performance impact, not just a slightly worse one.
Topics
Community Discussion
No community discussion yet for this question.