nerdexam
GIAC

GCIH · Question #34

You check performance logs and note that there has been a recent dramatic increase in the amount of broadcast traffic. What is this most likely to be an indicator of?

The correct answer is D. DoS attack. A dramatic increase in broadcast traffic is a strong indicator of a DoS attack, specifically a broadcast amplification attack like a Smurf attack.

Incident Response & Cyber Kill Chain

Question

You check performance logs and note that there has been a recent dramatic increase in the amount of broadcast traffic. What is this most likely to be an indicator of?

Options

  • AVirus
  • BSyn flood
  • CMisconfigured router
  • DDoS attack

How the community answered

(55 responses)
  • A
    5% (3)
  • B
    9% (5)
  • C
    4% (2)
  • D
    82% (45)

Why each option

A dramatic increase in broadcast traffic is a strong indicator of a DoS attack, specifically a broadcast amplification attack like a Smurf attack.

AVirus

Viruses may increase general network activity but do not specifically produce dramatic spikes in broadcast traffic as a primary, recognizable symptom.

BSyn flood

A SYN flood generates high volumes of TCP SYN packets directed at a specific host's port, not broadcast traffic distributed across the network.

CMisconfigured router

A misconfigured router may cause routing loops or dropped packets but is not the typical root cause of a sudden dramatic increase in broadcast traffic.

DDoS attackCorrect

A Smurf attack is a DoS technique that sends ICMP echo requests spoofed with the victim's IP to a network broadcast address, causing every host on the subnet to reply to the victim and producing a dramatic surge in broadcast traffic that degrades or halts network availability.

Concept tested: Identifying Smurf DoS attack via broadcast traffic

Source: https://www.cisa.gov/uscert/ncas/tips/ST04-015

Topics

#broadcast traffic#DoS indicator#network anomaly#performance monitoring

Community Discussion

No community discussion yet for this question.

Full GCIH Practice