Examkin

Soru

Zorluk: KolayCommon Network Attack Types and Vectors

A network administrator notices that an internal web server has suddenly stopped accepting new client connections. Analysis of packet captures shows thousands of incoming TCP packets with the SYN flag set coming from randomized source IP addresses, but none of these clients complete the three-way handshake with an ACK response. Which type of network attack is occurring?

  1. SYN flood attackCevap
  2. B
    ARP poisoning attack
  3. C
    DNS poisoning attack
  4. D
    Port scanning attack

Cevap

SYN flood attack
The correct answer is SYN flood attack. In a TCP SYN flood, an attacker sends repeated SYN requests to open ports on a server without completing the three-way handshake. The server keeps connection state queues open for ACK responses that never arrive, eventually exhausting server resources and causing a denial of service to legitimate users.

Adım Adım Çözüm

1
Analyze the network symptoms provided in the incident logs.
Identified high volumes of TCP SYN packets that leave connections half-open without sending final ACK responses.
This behavior directly targets the TCP connection queue capability of the destination server.
2
Match the observed packet behavior to standard network attack definitions.
Exhaustion of TCP handshake state resources by incomplete SYN requests is the defining characteristic of a TCP SYN flood Denial-of-Service attack.
Legitimate connections are denied because all available connection slots remain occupied by half-open requests.

Anahtar Kavram

TCP SYN Flood Attack
Tahmini Süre:45s
Bu soruyu puanla

Konular

Common Network Attack Types and Vectors

Bu konudan daha fazla soru