2.5 Describe Network Attacks, Such as Protocol-Based, Denial of Service, Distributed Denial of Service, and Man-In-The-Middle 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network administrator notices that a server is consuming excessive CPU and memory resources. The server logs show a large number of incomplete TCP connections in the SYN-RECEIVED state. The source IP addresses are spoofed and vary widely. Which attack is occurring, and what is the most effective mitigation?

   • APing of death; block all ICMP traffic at the firewall.
   • BSession hijacking; enforce stronger authentication on the server.
   • CSmurf attack; disable directed broadcast on the router.
   • DTCP SYN flood; enable SYN cookies on the server or configure the firewall to rate-limit new connections.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company's web server becomes unresponsive during a marketing campaign. The security team finds that the server is receiving a high volume of legitimate-looking HTTP GET requests for the homepage from a single IP address. The requests are coming faster than the server can process them. Which type of attack is this, and what is the most appropriate immediate action?

   • AA single-source denial of service (DoS) attack; block the source IP address at the firewall.
   • BA TCP SYN flood; enable SYN cookies on the server.
   • CA man-in-the-middle attack; enable HTTPS on the web server.
   • DA distributed denial of service (DDoS) attack; contact the ISP for traffic scrubbing.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A network engineer is reviewing firewall logs and sees a large number of ICMP echo requests with a destination address of 192.168.1.255. The requests are coming from an external source. The engineer suspects a Smurf attack. What is the primary mechanism of a Smurf attack, and what is the best mitigation?

   • AThe attacker sends oversized ICMP packets that crash the target; block all ICMP traffic at the firewall.
   • BThe attacker sends ARP replies to a broadcast address; enable Dynamic ARP Inspection.
   • CThe attacker sends ICMP echo requests to a directed broadcast address, causing all hosts on the network to reply to the spoofed source; disable directed broadcast on the router.
   • DThe attacker sends TCP SYN packets to a broadcast address; enable SYN cookies on the server.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary goal of a denial-of-service (DoS) attack?

   • ATo steal sensitive data from a target's database by injecting malicious queries.
   • BTo intercept and modify communications between two parties without their knowledge.
   • CTo gain unauthorized access to a system by exploiting a vulnerability.
   • DTo exhaust the resources of a target so that legitimate users cannot access the service.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is investigating an incident where a user's web session was hijacked. The attacker was able to predict the session token and inject packets into the TCP stream, allowing them to send commands as the user. Which attack technique is being described?

   • AA ping of death, which crashes the server
   • BA Smurf attack, which amplifies ICMP traffic
   • CSession hijacking, a form of MITM where the attacker takes over an authenticated session
   • DA TCP SYN flood, which exhausts the server's resources
   Reveal Solution Discussion Select an answer first