EC0-350 · Question #115
When a normal TCP connection starts, a destination host receives a SYN (synchronize/start) packet from a source host and sends back a SYN/ACK (synchronize acknowledge). The destination host must…
The correct answer is B. Attacker floods TCP SYN packets with random source addresses towards a victim host. See the full explanation below for the reasoning.
Question
When a normal TCP connection starts, a destination host receives a SYN (synchronize/start) packet from a source host and sends back a SYN/ACK (synchronize acknowledge). The destination host must then hear an ACK (acknowledge) of the SYN/ACK before the connection is established. This is referred to as the "TCP three-way handshake." While waiting for the ACK to the SYN ACK, a connection queue of finite size on the destination host keeps track of connections waiting to be completed. This queue typically empties quickly since the ACK is expected to arrive a few milliseconds after the SYN ACK. How would an attacker exploit this design by launching TCP SYN attack?
Options
- AAttacker generates TCP SYN packets with random destination addresses towards a victim host
- BAttacker floods TCP SYN packets with random source addresses towards a victim host
- CAttacker generates TCP ACK packets with random source addresses towards a victim host
- DAttacker generates TCP RST packets with random source addresses towards a victim host
How the community answered
(36 responses)- A3% (1)
- B81% (29)
- C6% (2)
- D11% (4)
Community Discussion
No community discussion yet for this question.