What is the difference between a zombie host and a reflector host?

Question

Options

• AUnlike a zombie, a reflector is a laundering host that fundamentally transforms and/or delays the
• BUnlike a zombie, a Traceback through the stepping stone host requires determining if two
• CUnlike a zombie host, the reflector is an uncompromised host that cooperates with the attack in an
• DA zombie is a version of a reflector host.

• A
  2% (1)
• B
  12% (5)
• C
  81% (35)
• D
  5% (2)

Explanation

Option C is correct because the key distinction is compromise status: a zombie is a host that has been taken over by malware (e.g., part of a botnet) and actively executes attack commands under attacker control, while a reflector is a legitimate, uncompromised server that unknowingly amplifies an attack simply by responding normally to spoofed requests (e.g., a DNS or NTP server responding to packets forged with the victim's IP address).

Why the distractors are wrong:

• A incorrectly frames the reflector as a "laundering host" that transforms traffic - reflectors don't obfuscate or delay; they just send normal replies to what appear to be legitimate requests.
• B conflates reflectors with stepping stone hosts, which are a separate concept used in attack-path traceback analysis, not in reflective amplification attacks.
• D is simply backwards - zombies and reflectors are distinct categories; a zombie is not a subtype of reflector.

Memory tip: Think Z = Zombie = hacked (Zero autonomy left) and R = Reflector = Real/legitimate server that Reflects traffic back - the reflector doesn't know it's being used, the zombie has no choice because it's already owned.

No community discussion yet for this question.