Denial-of-Service and DDoS CEH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is reviewing logs and finds that a server was overwhelmed by a large number of TCP SYN packets from many different source IPs, none of which completed the handshake. The analyst wants to identify the tool that could have been used to generate this attack. Which tool is most commonly associated with SYN floods?

   • ASlowloris
   • BLOIC
   • CHOIC
   • Dhping3
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A large online retailer is experiencing a DDoS attack that is a mix of UDP floods and HTTP GET floods. The company's on-premises mitigation appliance is struggling to keep up, and the ISP is threatening to null-route the company's IP if the attack continues. The company needs to maintain availability for customers. Which action is the most appropriate first step?

   • ABlock all UDP traffic at the firewall.
   • BIncrease the capacity of the on-premises mitigation appliance.
   • CAsk the ISP to null-route the IP address to stop the attack.
   • DSubscribe to a cloud-based DDoS protection service and reroute traffic through it.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company's e-commerce site is suffering from a DDoS attack that is overwhelming the web servers with a mix of SYN floods and HTTP GET floods. The company wants to maintain service availability for legitimate users while minimizing infrastructure changes. Which mitigation approach is most appropriate?

   • AUse a cloud-based DDoS protection service that scrubs traffic and forwards clean traffic to the origin.
   • BDeploy an on-premises intrusion prevention system (IPS) with signature-based rules.
   • CIncrease the bandwidth of the internet connection and add more web servers.
   • DConfigure the firewall to block all traffic from the attacking IPs.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which practice is a proactive countermeasure to reduce the impact of a DDoS attack?

   • ARemoving all network monitoring
   • BDisabling all firewall rules
   • CDeveloping an incident response plan
   • DIncreasing the number of open ports
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is investigating a DDoS attack and finds that the attacking machines are sending traffic to a command-and-control server to receive instructions. The analyst also notices that the attack uses a technique where small queries are sent to publicly accessible servers, which then send large responses to the victim. Which two elements are present in this attack?

   • ABotnet and SYN flood
   • BReflection and slowloris
   • CBotnet and DNS amplification
   • DC2 server and HTTP flood
   Reveal Solution Discussion Select an answer first