Examkin

Question

Difficulty: HardCommon Network Attack Types and Vectors

During a security incident investigation, a network analyst reviews packet captures from an ongoing Distributed Denial of Service (DDoS) event targeting an enterprise's web server. The logs reveal a high volume of inbound UDP traffic originating from standard network management servers on external networks. The attacker initiated this traffic by transmitting small query packets with a forged source IP address matching the victim's public server, inducing the external servers to transmit significantly larger response payloads back to the victim. Which of the following attack vectors is being executed in this scenario?

  1. A
    ARP Cache Poisoning Attack
  2. NTP Reflection and Amplification AttackAnswer
  3. C
    DNS Resource Record Poisoning Attack
  4. D
    TCP SYN Flood Attack over Port 123

Answer

NTP Reflection and Amplification Attack
The scenario describes an amplification and reflection DDoS attack. The attacker sends small UDP requests (such as NTP monlist queries) with a spoofed source IP address corresponding to the victim's IP. The open third-party servers reply to the victim with significantly larger payloads, reflecting and amplifying the attack volume.

Step-by-Step Solution

1
Analyze traffic characteristics and transport protocols from the incident log.
Identified high-volume UDP traffic originating from external time management servers targeting port 123.
Determining the protocol (UDP) and service (NTP/port 123) isolates the specific vector exploited.
2
Evaluate the mechanism of IP address manipulation and response size discrepancy.
Forged source IP addresses (IP spoofing) caused third-party servers to send disproportionately large payload responses to the victim.
This behavior defines a classic reflection and amplification mechanism where small queries yield massive response amplification factor multipliers.
3
Select the attack classification matching both the protocol vector and amplification mechanism.
Confirmed the incident as an NTP Reflection and Amplification Attack.
No other choice correctly combines connectionless UDP reflection, IP spoofing, and amplification capabilities.

Key Concept

NTP Reflection and Amplification Attack Mechanics
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic