Against which of the following does SSH provide protection? Each correct answer represents a complete solution. Choose two.

SSH operates at the application layer and cannot prevent DoS attacks, which exploit the network and transport layers by overwhelming a host with traffic before SSH even has a chance to authenticate.

SSH authenticates remote hosts using public-key cryptography, which prevents IP spoofing by ensuring the connecting system can prove possession of the private key corresponding to its known public key - a forged source IP cannot pass this verification.

SSH encrypts the entire session including credentials using symmetric encryption negotiated during the handshake, making it impossible for a network sniffer to recover plaintext passwords from captured traffic.

Broadcast storms are a Layer 2 switching problem caused by loops in the network topology and are addressed by protocols like STP - SSH has no mechanism to influence or prevent them.