nerdexam
CompTIA

SY0-501 · Question #524

A malicious system continuously sends an extremely large number of SYN packets to a server. Which of the following BEST describes the resulting effect?

The correct answer is D. The server will exhaust its memory maintaining half-open connections. A SYN flood attack overwhelms a server by continuously sending a large number of SYN packets, causing it to allocate resources for incomplete connections.

Submitted by kevin_r· Mar 4, 2026Threats, vulnerabilities, and mitigations

Question

A malicious system continuously sends an extremely large number of SYN packets to a server. Which of the following BEST describes the resulting effect?

Options

  • AThe server will be unable to server clients due to lack of bandwidth
  • Bthe server's firewall will be unable to effectively filter traffic due to the amount of data transmitted
  • CThe server will crash when trying to reassemble all the fragmented packets
  • DThe server will exhaust its memory maintaining half-open connections

How the community answered

(39 responses)
  • A
    13% (5)
  • B
    3% (1)
  • C
    5% (2)
  • D
    79% (31)

Why each option

A SYN flood attack overwhelms a server by continuously sending a large number of SYN packets, causing it to allocate resources for incomplete connections.

AThe server will be unable to server clients due to lack of bandwidth

While a large volume of traffic can consume bandwidth, the primary impact of a SYN flood on the server is the exhaustion of its internal connection state resources, not necessarily the consumption of network bandwidth by the small SYN packets themselves.

Bthe server's firewall will be unable to effectively filter traffic due to the amount of data transmitted

A SYN flood aims to exhaust connection resources rather than overwhelm a firewall's ability to filter traffic based on the amount of data transmitted, as individual SYN packets are small.

CThe server will crash when trying to reassemble all the fragmented packets

SYN packets are not typically fragmented, and a SYN flood does not primarily involve fragmented packets or their reassembly; this describes a different type of attack.

DThe server will exhaust its memory maintaining half-open connectionsCorrect

During a SYN flood attack, the server receives numerous SYN packets and responds with SYN-ACKs, allocating memory and resources to maintain the state of each 'half-open' connection in its SYN queue, waiting for the final ACK. Since the attacker never sends the final ACK, these half-open connections accumulate, eventually exhausting the server's memory and connection table limits, preventing legitimate clients from establishing new connections.

Concept tested: SYN flood attack and TCP connection state exhaustion

Source: https://learn.microsoft.com/en-us/windows-server/security/ts-security/security-attacks-and-countermeasures-tcp-ip

Topics

#SYN flood#DoS attack#TCP handshake#half-open connections

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice