GCIH · Question #155
Which of the following statements are true regarding SYN flood attack?
The correct answer is A. The attacker sends a succession of SYN requests to a target system. B. SYN flood is a form of Denial-of-Service (DoS) attack. D. SYN cookies provide protection against the SYN flood by eliminating the resources. A SYN flood attack exploits the TCP three-way handshake by sending many SYN requests without completing the handshake, exhausting server resources. SYN cookies mitigate this by deferring resource allocation until the handshake is verified.
Question
Which of the following statements are true regarding SYN flood attack?
Options
- AThe attacker sends a succession of SYN requests to a target system.
- BSYN flood is a form of Denial-of-Service (DoS) attack.
- CThe attacker sends thousands and thousands of ACK packets to the victim.
- DSYN cookies provide protection against the SYN flood by eliminating the resources
How the community answered
(28 responses)- A86% (24)
- C14% (4)
Why each option
A SYN flood attack exploits the TCP three-way handshake by sending many SYN requests without completing the handshake, exhausting server resources. SYN cookies mitigate this by deferring resource allocation until the handshake is verified.
The attacker sends a rapid succession of SYN packets to initiate half-open TCP connections, which is the defining mechanism of a SYN flood.
SYN flood is a form of DoS because it exhausts the server's connection table with half-open connections, denying service to legitimate users.
SYN flood attacks use SYN packets, not ACK packets - the attacker deliberately withholds the final ACK to keep connections in a half-open state and exhaust resources.
SYN cookies eliminate the vulnerability by encoding connection state in the ISN (Initial Sequence Number) so the server does not allocate a TCB (Transmission Control Block) until the client returns a valid ACK, preventing resource exhaustion.
Concept tested: SYN flood mechanics and SYN cookie mitigation
Source: https://www.rfc-editor.org/rfc/rfc4987
Topics
Community Discussion
No community discussion yet for this question.