SY0-501 · Question #524
A malicious system continuously sends an extremely large number of SYN packets to a server. Which of the following BEST describes the resulting effect?
The correct answer is D. The server will exhaust its memory maintaining half-open connections. A SYN flood attack overwhelms a server by continuously sending a large number of SYN packets, causing it to allocate resources for incomplete connections.
Question
A malicious system continuously sends an extremely large number of SYN packets to a server. Which of the following BEST describes the resulting effect?
Options
- AThe server will be unable to server clients due to lack of bandwidth
- Bthe server's firewall will be unable to effectively filter traffic due to the amount of data transmitted
- CThe server will crash when trying to reassemble all the fragmented packets
- DThe server will exhaust its memory maintaining half-open connections
How the community answered
(39 responses)- A13% (5)
- B3% (1)
- C5% (2)
- D79% (31)
Why each option
A SYN flood attack overwhelms a server by continuously sending a large number of SYN packets, causing it to allocate resources for incomplete connections.
While a large volume of traffic can consume bandwidth, the primary impact of a SYN flood on the server is the exhaustion of its internal connection state resources, not necessarily the consumption of network bandwidth by the small SYN packets themselves.
A SYN flood aims to exhaust connection resources rather than overwhelm a firewall's ability to filter traffic based on the amount of data transmitted, as individual SYN packets are small.
SYN packets are not typically fragmented, and a SYN flood does not primarily involve fragmented packets or their reassembly; this describes a different type of attack.
During a SYN flood attack, the server receives numerous SYN packets and responds with SYN-ACKs, allocating memory and resources to maintain the state of each 'half-open' connection in its SYN queue, waiting for the final ACK. Since the attacker never sends the final ACK, these half-open connections accumulate, eventually exhausting the server's memory and connection table limits, preventing legitimate clients from establishing new connections.
Concept tested: SYN flood attack and TCP connection state exhaustion
Source: https://learn.microsoft.com/en-us/windows-server/security/ts-security/security-attacks-and-countermeasures-tcp-ip
Topics
Community Discussion
No community discussion yet for this question.