nerdexam
Cisco

350-201 · Question #90

Refer to the exhibit. What is the threat in this Wireshark traffic capture?

The correct answer is D. A flood of SYN packets coming from a single source IP to a single destination IP. The Wireshark capture shows a TCP SYN flood denial-of-service attack, where a single source IP sends a high volume of SYN packets to a single destination IP to exhaust its connection state table.

Network Intrusion Analysis

Question

Refer to the exhibit. What is the threat in this Wireshark traffic capture?

Exhibit

350-201 question #90 exhibit

Options

  • AA high rate of SYN packets being sent from multiple sources toward a single destination IP
  • BA flood of ACK packets coming from a single source IP to multiple destination IPs
  • CA high rate of SYN packets being sent from a single source IP toward multiple destination IPs
  • DA flood of SYN packets coming from a single source IP to a single destination IP

How the community answered

(39 responses)
  • A
    8% (3)
  • B
    15% (6)
  • C
    3% (1)
  • D
    74% (29)

Why each option

The Wireshark capture shows a TCP SYN flood denial-of-service attack, where a single source IP sends a high volume of SYN packets to a single destination IP to exhaust its connection state table.

AA high rate of SYN packets being sent from multiple sources toward a single destination IP

SYN packets arriving from multiple sources toward a single destination describes a distributed SYN flood (DDoS), which is a different attack pattern requiring multiple compromised hosts - not what a single-source capture shows.

BA flood of ACK packets coming from a single source IP to multiple destination IPs

A flood of ACK packets from a single source to multiple destinations describes an ACK flood or a reflective amplification pattern, which is a distinct attack type not consistent with the SYN-based traffic shown in the capture.

CA high rate of SYN packets being sent from a single source IP toward multiple destination IPs

SYN packets sent from one source toward multiple destination IPs describes network reconnaissance or a port scan across a subnet, not a focused denial-of-service SYN flood targeting a single host.

DA flood of SYN packets coming from a single source IP to a single destination IPCorrect

A SYN flood is a denial-of-service attack in which an attacker sends a continuous stream of TCP SYN packets to a target server from one source IP, causing the server to allocate resources for half-open connections that are never completed by the three-way handshake. The server's connection table fills to capacity, preventing it from accepting legitimate new connections. In Wireshark, this pattern is visible as a high volume of SYN packets from a single source IP all directed at the same destination IP with no corresponding ACK completions from the initiating side.

Concept tested: TCP SYN flood DoS attack identification in packet capture

Source: https://www.cloudflare.com/learning/ddos/syn-flood-ddos-attack/

Topics

#SYN flood#DDoS#Wireshark analysis#TCP traffic

Community Discussion

No community discussion yet for this question.

Full 350-201 Practice