NSE4 · Question #525
Which best describes the mechanism of a TCP SYN flood?
The correct answer is D. The attacker starts many connections, but never acknowledges to fully form them. A TCP SYN flood is a denial-of-service attack where an attacker initiates numerous TCP connections but never completes the handshake, exhausting the target's connection state resources.
Question
Which best describes the mechanism of a TCP SYN flood?
Options
- AThe attackers keeps open many connections with slow data transmission so that other clients
- BThe attackers sends a packets designed to sync with the FortiGate
- CThe attacker sends a specially crafted malformed packet, intended to crash the target by
- DThe attacker starts many connections, but never acknowledges to fully form them.
How the community answered
(41 responses)- A2% (1)
- B5% (2)
- D93% (38)
Why each option
A TCP SYN flood is a denial-of-service attack where an attacker initiates numerous TCP connections but never completes the handshake, exhausting the target's connection state resources.
Keeping open many connections with slow data transmission describes a "slowloris" or similar application-layer DoS attack, not a SYN flood.
Sending packets to "sync" with the FortiGate is vague and doesn't accurately describe the malicious mechanism of a SYN flood, which specifically exploits the TCP handshake.
Sending specially crafted malformed packets to crash a target describes a different type of exploit, often involving buffer overflows or protocol vulnerabilities, not a SYN flood.
In a SYN flood, the attacker sends many SYN requests, but does not respond to the server's SYN-ACKs, leaving many half-open connections that exhaust the server's connection table or memory.
Concept tested: TCP SYN flood attack mechanism
Source: https://docs.fortinet.com/document/fortigate/7.4.0/new-features/618274/syn-flood-protection
Topics
Community Discussion
No community discussion yet for this question.