2.5 Describe Network Attacks, Such as Protocol-Based, Denial of Service, Distributed Denial of Service, and Man-In-The-Middle 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which characteristic best describes a TCP SYN flood attack?

   • AIt sends oversized ICMP packets that cause the target to crash or reboot.
   • BIt sends malformed TCP packets with invalid flags to crash the target's network stack.
   • CIt uses a broadcast address to amplify ICMP echo requests and flood a victim with replies.
   • DIt floods a target with spoofed SYN packets to exhaust the connection queue and prevent legitimate connections.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary mechanism of a Smurf attack?

   • ASending spoofed ICMP echo requests to a broadcast address, causing all hosts to reply to the victim.
   • BIntercepting and modifying ICMP traffic between two hosts to alter routing decisions.
   • CSending oversized ICMP packets to cause a buffer overflow in the target's network stack.
   • DSending thousands of TCP SYN packets to exhaust the target's connection queue.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A network administrator suspects that an attacker is intercepting traffic between two servers on the same VLAN. The administrator checks the switch's MAC address table and finds that the port connected to Server A has multiple MAC addresses, including the MAC of Server B. Which attack is likely occurring?

   • AA Smurf attack, which sends ICMP to the broadcast address
   • BA ping of death, which crashes the switch
   • CARP spoofing, where the attacker sends forged ARP replies to associate their MAC with Server B's IP
   • DA TCP SYN flood, which fills the switch's MAC table
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst observes a sudden spike in traffic to a company's public-facing DNS server. The traffic consists of large ICMP echo requests sent to the DNS server's broadcast address, and the server is overwhelmed by the volume of replies. The source of the initial requests appears to be a single compromised host. Which attack is being described?

   • AA man-in-the-middle attack, which intercepts DNS queries to redirect traffic
   • BA Smurf attack, which uses a broadcast address to amplify a single source into many replies
   • CA TCP SYN flood, which exhausts the server's connection table
   • DA ping of death, which sends oversized ICMP packets to crash the server
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A small business hosts a web server on a single internet connection. An attacker sends a continuous stream of UDP packets to the server's public IP, saturating the uplink and making the server unreachable. The analyst identifies that all packets originate from one IP address. Which classification best describes this attack?

   • AA protocol-based attack, because it exploits a TCP handshake flaw
   • BA single-source DoS attack, because the traffic comes from one IP address
   • CA man-in-the-middle attack, because the attacker is intercepting the server's traffic
   • DA distributed DoS attack, because the attack uses UDP packets
   Reveal Solution Discussion Select an answer first