A network administrator notices that a web server's connection table is full of entries in SYN_RECEIVED state, and the server is no longer accepting new connections. The administrator suspects a network-based attack. Which two protocol characteristics are being exploited in this scenario?

TCP's three-way handshake requires the server to allocate state before the handshake completes, and ICMP can be used to spoof source addresses.

TCP's sequence numbers are predictable, and ICMP redirect messages can be used to reroute traffic away from the server.

TCP's window size is negotiated without authentication, and ICMP echo requests can be sent in a continuous stream to exhaust bandwidth.

TCP's FIN flag can be set to half-open connections, and ICMP timestamp requests can be used to map the network.

A user on the corporate network reports that when they visit an internal HR portal, the page shows a login form that looks normal, but after submitting credentials, the user is redirected to a phishing site. A packet capture shows the traffic to the HR portal is in plaintext. Which vulnerability is most directly being exploited?

DNS cache poisoning changing the IP address of the HR portal

TCP sequence prediction allowing session hijacking

HTTP plaintext transmission allowing a man-in-the-middle to inject content

ARP spoofing causing the user to reach a different server

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 2Objective 1

Describe TCP/IP Protocol Vulnerabilities 100-160 Practice Questions (Page 10)

Part of the Basic Network Security Concepts domain, which makes up ~19% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~4–7 in this domain), expect 1–1 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

7concepts

Questions 46–48

46application · medium
A network administrator notices that a web server's connection table is full of entries in SYN_RECEIVED state, and the server is no longer accepting new connections. The administrator suspects a network-based attack. Which two protocol characteristics are being exploited in this scenario?
Select an answer first
47application · medium
A user on the corporate network reports that when they visit an internal HR portal, the page shows a login form that looks normal, but after submitting credentials, the user is redirected to a phishing site. A packet capture shows the traffic to the HR portal is in plaintext. Which vulnerability is most directly being exploited?
Select an answer first
48application · medium
A company has a flat network with no DHCP snooping. Several users report that they cannot reach the internet, and their workstations have IP addresses in the 192.168.50.0/24 range, which is not the company's DHCP scope. The company's DHCP server is on the 192.168.10.0/24 network. Which attack is most likely the cause?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.

Describe TCP/IP Protocol Vulnerabilities 100-160 Practice Questions (Page 10)

Questions 46–48

A network administrator notices that a web server's connection table is full of entries in SYN_RECEIVED state, and the server is no longer accepting new connections. The administrator suspects a network-based attack. Which two protocol characteristics are being exploited in this scenario?

Keep studying — Basic Network Security Concepts