DoS and DDoS Attack Methods EHE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company's web server is under a SYN flood attack. The administrator has enabled SYN cookies, but the server is still struggling because the attack is also generating a high volume of ACK packets that do not correspond to any established connection. What additional measure should be taken?

   • ADeploy a stateful firewall that can track connection states and drop invalid ACK packets
   • BDisable TCP timestamps on the server
   • CBlock all ACK packets at the firewall
   • DIncrease the server's TCP backlog queue
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company's internet link is saturated with a mix of large UDP packets from DNS and NTP servers. The packets are responses to spoofed queries from the company's IP range. The company's own DNS and NTP servers are not the source. The company has a limited budget and must maintain internet connectivity for its users. Which mitigation strategy is most effective?

   • ABlock all UDP traffic from DNS and NTP servers at the firewall
   • BDeploy a DDoS mitigation service that can filter the amplified traffic
   • CIncrease the company's internet bandwidth
   • DConfigure the company's DNS and NTP servers to ignore external queries
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A cybersecurity analyst is investigating a DDoS attack against a client's website. The attack traffic originates from thousands of IP addresses, but the packets show a consistent pattern: they all use the same TTL value and the same TCP window size. The analyst suspects a botnet. Which characteristic of the attack most strongly supports the botnet hypothesis?

   • AThe attack lasts for several hours
   • BThe attack uses multiple source IP addresses
   • CThe attack traffic shows consistent TTL and TCP window size
   • DThe attack targets a specific port
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A media streaming service is hit by a DDoS attack that generates massive traffic from thousands of IoT devices, including cameras and routers. The traffic consists of UDP packets to random ports on the streaming servers. The company wants to mitigate the attack without affecting legitimate users. Which approach is most effective?

   • ABlock all UDP traffic to the streaming servers
   • BDisable UDP on the operating system of the streaming servers
   • CUse a CDN and DDoS protection service that can absorb volumetric attacks
   • DIncrease the bandwidth of the internet connection
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which protocol is exploited in an NTP amplification attack?

   • AInternet Control Message Protocol (ICMP)
   • BDomain Name System (DNS)
   • CNetwork Time Protocol (NTP)
   • DTransmission Control Protocol (TCP)
   Reveal Solution Discussion Select an answer first