NSE4 · Question #365
Which best describe the mechanism of a TCP SYN flood?
The correct answer is D. The attacker starts many connections, but never acknowledges to fully form them. A TCP SYN flood is a denial-of-service attack where an attacker rapidly sends many TCP SYN requests to a target but never completes the handshake, exhausting the target's connection resources.
Question
Which best describe the mechanism of a TCP SYN flood?
Options
- AThe attacker keeps open many connections with slow data transmission so that other clients
- BThe attacker sends a packet designed to "sync" with the FortiGate.
- CThe attacker sends a specially crafted malformed packet, intended to crash the target by
- DThe attacker starts many connections, but never acknowledges to fully form them.
How the community answered
(28 responses)- A4% (1)
- B7% (2)
- C4% (1)
- D86% (24)
Why each option
A TCP SYN flood is a denial-of-service attack where an attacker rapidly sends many TCP SYN requests to a target but never completes the handshake, exhausting the target's connection resources.
This describes a "slowloris" or similar slow HTTP/connection-based attack, not a SYN flood.
While SYN packets are part of the attack, simply sending one "sync" packet does not constitute a SYN flood; the attack involves a *flood* of unacknowledged SYN packets.
Sending a specially crafted malformed packet is characteristic of a malformed packet attack or buffer overflow attempt, not specifically a SYN flood.
In a TCP SYN flood, the attacker sends numerous SYN (synchronize) packets to the target server but either uses a spoofed source IP address or deliberately fails to send the final ACK (acknowledgment) packet, leaving the server with many half-open connections that exhaust its connection table and resources.
Concept tested: TCP SYN flood attack mechanism
Source: https://docs.fortinet.com/document/fortigate/7.4.0/fortios-handbook/475176/syn-proxy-and-ack-proxy
Topics
Community Discussion
No community discussion yet for this question.