Examkin

Question

Difficulty: MediumCommon Network Attack Types and Vectors

An enterprise security monitoring system generates an alert after detecting an unexpected surge in incoming UDP traffic targeted at a company's public-facing web server. Analysis of packet captures reveals thousands of external open recursive DNS servers sending large response payloads for ANY and TXT queries that were never initiated by the web server. The source IP address in the initial queries was forged to match the public IP address of the target server, causing severe link congestion. Which type of network attack is occurring?

  1. DNS amplification attackAnswer
  2. B
    ARP poisoning attack
  3. C
    Port scanning attack
  4. D
    Rogue DNS record injection attack

Answer

The attack being conducted is a DNS amplification attack.
The correct answer describes a DNS amplification attack. In this attack vector, the threat actor sends small DNS queries for resource-heavy records (such as TXT or ANY) to third-party open DNS resolvers while forging (spoofing) the source IP address to be that of the victim. The resolvers reply to the victim with enlarged responses, resulting in volumetric bandwidth saturation.

Step-by-Step Solution

1
Analyze the observed attack mechanism described in the packet capture.
Unsolicited large DNS response traffic (such as TXT/ANY records) is arriving from multiple external open resolvers.
The attacker sent queries requesting large responses while spoofing the victim server's source IP address.
2
Evaluate how traffic amplification causes network degradation.
A small request generates a significantly larger response payload delivered directly to the spoofed victim IP address.
This disparity in request vs. response size amplifies the total attack volume, leading to denial of service via bandwidth starvation.
3
Identify the specific attack classification based on these characteristics.
The scenario describes a DNS amplification attack, which is a reflective DDoS attack vector.
It relies on open recursive DNS resolvers and IP spoofing to reflect amplified traffic onto the target.

Key Concept

DNS Amplification and Reflective DDoS Attacks
Estimated Time:1m 15s
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic