100-160 Question 56
Single answerAn attacker exploits a vulnerability in the TCP three-way handshake by sending a large number of SYN packets to a server but never completing the handshake. As a result, the server's resources are overwhelmed. Which TCP/IP protocol vulnerability is the attacker exploiting?
- A
SYN Flood Attack
- B
IP Spoofing
- C
Man-in-the-Middle Attack
- D
DNS Spoofing
Show answer and explanation
Correct answer: A
Explanation
The scenario describes a SYN Flood Attack, where an attacker exploits the TCP three-way handshake by sending numerous SYN packets and not completing the handshake. This forces the server to keep connections open, consuming resources and potentially causing a denial-of-service condition. This is a common TCP/IP protocol vulnerability that attackers exploit.
- A. Correct.
SYN Flood Attack is a type of denial-of-service attack that exploits the TCP three-way handshake by sending numerous SYN packets without completing the handshake, causing the server to consume resources unnecessarily.
- B. Incorrect.
IP Spoofing involves forging the source IP address in packets to impersonate another device, but it does not directly exploit the TCP handshake process as described in the scenario.
- C. Incorrect.
Man-in-the-Middle Attack involves intercepting and altering communication between two parties, which is unrelated to the described attack on the TCP handshake.
- D. Incorrect.
DNS Spoofing involves redirecting users to malicious websites by altering DNS records, which is not related to the TCP handshake or server resource exhaustion.