CS0-003 · Question #551
A security analyst observes a high volume of SYN flags from an unexpected source toward a web application server within one hour. The traffic is not flagging for any exploit signatures. Which of the f
The correct answer is C. An attacker is executing reconnaissance activities by mapping which ports are open and closed.. A high volume of SYN flags without completing the three-way TCP handshake (SYN-ACK and ACK) is characteristic of reconnaissance activities, such as a TCP SYN scan. Attackers use SYN scans to map open and closed ports on a target system without fully establishing connections. The
Question
A security analyst observes a high volume of SYN flags from an unexpected source toward a web application server within one hour. The traffic is not flagging for any exploit signatures. Which of the following scenarios best describes this activity?
Options
- AA legitimate connection is continuously attempting to establish a connection with a downed web
- BA script kiddie is attempting to execute a DDoS through a ping flood attack.
- CAn attacker is executing reconnaissance activities by mapping which ports are open and closed.
- DA web exploit attempt is likely occurring and the security analyst is not seeing it.
How the community answered
(24 responses)- A8% (2)
- B4% (1)
- C83% (20)
- D4% (1)
Explanation
A high volume of SYN flags without completing the three-way TCP handshake (SYN-ACK and ACK) is characteristic of reconnaissance activities, such as a TCP SYN scan. Attackers use SYN scans to map open and closed ports on a target system without fully establishing connections. The lack of exploit signatures in the traffic supports the conclusion that this is reconnaissance rather than an active exploitation attempt.
Topics
Community Discussion
No community discussion yet for this question.