Denial-of-Service and DDoS CEH Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary difference between a denial-of-service (DoS) attack and a distributed denial-of-service (DDoS) attack?

   • AA DoS attack targets the application layer, while a DDoS attack targets the network layer.
   • BA DoS attack is launched by malware, while a DDoS attack is launched by manual commands.
   • CA DoS attack uses a single source, while a DDoS attack uses multiple coordinated sources.
   • DA DoS attack is always more severe than a DDoS attack.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company's online banking portal is experiencing intermittent slowdowns. The security team finds that the attack traffic consists of many TCP connections that are established but then send no data, tying up server resources. The connections come from a large botnet. Which type of attack is this, and what is the best mitigation?

   • ASlowloris attack; increase the server's maximum connection timeout.
   • BTCP SYN flood; enable SYN cookies.
   • CHTTP POST flood; deploy a load balancer.
   • DSlowloris attack; configure the web server to limit the number of connections per IP and reduce timeout values.
   Reveal Solution Discussion Select an answer first
4. 18application · easy

   A DDoS attack is using spoofed source IPs to send small queries to many public DNS servers, which then send large responses to the victim. This is an example of which type of attack?

   • ADNS amplification attack
   • BHTTP GET flood
   • CDirect DNS flood
   • DSYN flood
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In a DNS amplification attack, how does the attacker achieve a large volume of traffic directed at the victim?

   • ABy flooding the victim's DNS server with large responses
   • BBy sending small queries with spoofed source IP addresses to open DNS resolvers
   • CBy using a botnet to send DNS queries directly to the victim
   • DBy sending many requests to the victim's DNS server directly
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A web application is experiencing intermittent slowdowns. The server logs show many incomplete HTTP connections where the client sends the initial request but never completes the handshake or sends the full request. The connections are from various IPs. Which type of attack is this, and what mitigation is most effective?

   • ASYN flood; enable SYN cookies.
   • BHTTP POST flood; enable request body size limits.
   • CSlowloris attack; reduce the server's connection timeout and limit concurrent connections per IP.
   • DSlowloris attack; increase the server's maximum connection timeout.
   Reveal Solution Discussion Select an answer first