2.5 Describe Network Attacks, Such as Protocol-Based, Denial of Service, Distributed Denial of Service, and Man-In-The-Middle 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why do DDoS attacks often have a greater impact than single-source DoS attacks?

   • ABecause they exploit a specific vulnerability in the target's operating system to crash it instantly.
   • BBecause they always target the application layer, which is more difficult to protect.
   • CBecause they use multiple compromised systems to generate a much larger volume of traffic from many different sources.
   • DBecause they use encrypted traffic that cannot be inspected by security devices.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A network administrator notices that a server is receiving a large number of ICMP echo requests with a payload larger than the maximum allowed size. The server's operating system is crashing and rebooting. Which attack is occurring, and what is the best mitigation?

   • APing of death; block oversized ICMP packets at the firewall.
   • BMan-in-the-middle attack; enable HTTPS on the server.
   • CTCP SYN flood; enable SYN cookies on the server.
   • DSmurf attack; disable directed broadcast on the router.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A user reports that when they visit a banking website, the page loads but shows a certificate warning. The analyst checks the network and finds that the user's ARP cache maps the default gateway's IP to an unknown MAC address. Which attack is most likely in progress, and what is the immediate impact?

   • AA TCP SYN flood, causing the gateway to drop legitimate connections
   • BA ping of death, crashing the user's network stack
   • CARP spoofing, allowing the attacker to intercept and potentially modify traffic between the user and the gateway
   • DA Smurf attack, overwhelming the user's bandwidth with ICMP replies
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary objective of a man-in-the-middle (MITM) attack?

   • ATo gain unauthorized access to a server by guessing weak passwords.
   • BTo infect a system with malware that encrypts files and demands ransom.
   • CTo overwhelm a target with traffic so that it cannot respond to legitimate requests.
   • DTo intercept and potentially alter communications between two parties without their knowledge.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A small e-commerce company hosts its web application on a single server. During a sales event, the server becomes unresponsive. The network team observes a massive volume of ICMP echo requests arriving from thousands of distinct source IP addresses, all directed at the server's public IP. The packets are small and appear to be from spoofed addresses. Which type of attack is most likely occurring, and what immediate mitigation would be most effective?

   • AA single-source denial of service (DoS) attack using a Smurf attack; block all ICMP traffic at the server's host firewall.
   • BA distributed denial of service (DDoS) attack using ICMP flood; configure the perimeter firewall to rate-limit ICMP traffic.
   • CA man-in-the-middle attack using ARP spoofing; configure port security on the access switches.
   • DA protocol-based attack using a TCP SYN flood; enable SYN cookies on the server's operating system.
   Reveal Solution Discussion Select an answer first