nerdexam
EC-Council

EC0-350 · Question #115

When a normal TCP connection starts, a destination host receives a SYN (synchronize/start) packet from a source host and sends back a SYN/ACK (synchronize acknowledge). The destination host must…

The correct answer is B. Attacker floods TCP SYN packets with random source addresses towards a victim host. See the full explanation below for the reasoning.

Question

When a normal TCP connection starts, a destination host receives a SYN (synchronize/start) packet from a source host and sends back a SYN/ACK (synchronize acknowledge). The destination host must then hear an ACK (acknowledge) of the SYN/ACK before the connection is established. This is referred to as the "TCP three-way handshake." While waiting for the ACK to the SYN ACK, a connection queue of finite size on the destination host keeps track of connections waiting to be completed. This queue typically empties quickly since the ACK is expected to arrive a few milliseconds after the SYN ACK. How would an attacker exploit this design by launching TCP SYN attack?

Options

  • AAttacker generates TCP SYN packets with random destination addresses towards a victim host
  • BAttacker floods TCP SYN packets with random source addresses towards a victim host
  • CAttacker generates TCP ACK packets with random source addresses towards a victim host
  • DAttacker generates TCP RST packets with random source addresses towards a victim host

How the community answered

(36 responses)
  • A
    3% (1)
  • B
    81% (29)
  • C
    6% (2)
  • D
    11% (4)

Community Discussion

No community discussion yet for this question.

Full EC0-350 Practice