2.5 Describe Network Attacks, Such as Protocol-Based, Denial of Service, Distributed Denial of Service, and Man-In-The-Middle 200-201 Practice Questions (Page 5)

Questions 21–23

1. 21application · medium

   A company's web server is experiencing intermittent outages. The security team finds that the server is receiving a high volume of TCP SYN packets from a single IP address, but the server's SYN queue is filling up and legitimate connections are being dropped. Which type of attack is this, and what is the most effective mitigation?

   • AA distributed TCP SYN flood; enable SYN cookies on the server.
   • BA single-source TCP SYN flood; block the source IP at the firewall.
   • CA man-in-the-middle attack; enable HTTPS on the server.
   • DA Smurf attack; disable directed broadcast on the router.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company's e-commerce site is hit by a DDoS attack that uses a botnet of thousands of compromised IoT devices to send HTTP requests to the web server, overwhelming its CPU and memory. Which characteristic distinguishes this attack from a single-source DoS attack?

   • AThe attack uses multiple distributed sources, making it harder to block by IP address alone
   • BThe attack only affects the application layer, not the network layer
   • CThe attack requires physical access to the target network
   • DThe attack uses a single protocol, making it easier to detect
   Reveal Solution Discussion Select an answer first
3. 23application · medium

   A network engineer is troubleshooting a server that becomes unresponsive every day at the same time. The server logs show a large number of incomplete TCP handshakes from a single IP address. The engineer suspects a SYN flood. Which mitigation would be most effective in preventing the exhaustion of the server's connection table?

   • AIncrease the server's MTU to handle larger packets
   • BEnable ARP spoofing protection on the server
   • CDisable ICMP echo replies on the server
   • DConfigure the server's firewall to limit the rate of incoming SYN packets from that IP
   Reveal Solution Discussion Select an answer first