Examkin

Question

Difficulty: MediumCommon Network Attack Types and Vectors

During a bandwidth exhaustion incident, a network administrator inspects packet captures at the perimeter firewall. The logs show a massive influx of inbound UDP traffic on port 123 directed at an enterprise public IP address. The payload responses originate from third-party public time servers responding to spoofed monlistmonlist commands that the target enterprise never initiated. Which of the following network attack types is being executed?

  1. NTP Amplification AttackAnswer
  2. B
    DNS Amplification Attack
  3. C
    ARP Poisoning Attack
  4. D
    DNS Cache Poisoning

Answer

NTP Amplification Attack is being executed.
An NTP Amplification attack is a Distributed Denial of Service (DDoS) vector where attackers exploit publicly exposed Network Time Protocol (NTP) servers running on UDP port 123. By sending requests with a spoofed source IP (the victim's IP address) using commands like monlist—which returns a list of up to 600 recent clients—the attacker forces the time server to reply with a payload up to hundreds of times larger than the request. The target receives a massive wave of unsolicited responses, resulting in extreme network bandwidth exhaustion.

Step-by-Step Solution

1
Analyze the service and port number identified in the packet capture.
UDP port 123 corresponds directly to Network Time Protocol (NTP).
Identifying the transport protocol and port establishes the application protocol being exploited.
2
Examine the attack payload behavior and traffic direction.
The target receives unrequested high-volume responses triggered by spoofed request queries (such as the monlist command).
This behavior defines a reflection and amplification distributed denial-of-service attack mechanism.
3
Correlate the protocol and attack structure to determine the precise threat classification.
Combining UDP port 123 (NTP) with reflection/amplification tactics confirms an NTP Amplification Attack.
Differentiates this specific vector from other reflection techniques like DNS amplification or localized protocol poisoning.

Key Concept

NTP Amplification Attack
Estimated Time:1m 30s
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic