100-160 Question 57
Select 2A security analyst notices unusual traffic patterns on a network and suspects a TCP SYN flood attack is occurring. Which TCP/IP protocol vulnerabilities does this attack exploit?
- A
TCP's three-way handshake process relies on maintaining a state for each connection.
- B
The IP protocol lacks authentication mechanisms, making it susceptible to spoofing.
- C
TCP does not limit the number of SYN requests that can be sent to a server.
- D
The UDP protocol does not provide a mechanism for reliable data transmission.
- E
TCP retransmission mechanisms can lead to resource exhaustion under certain conditions.
Show answer and explanation
Correct answers: A, C
Explanation
A TCP SYN flood attack exploits vulnerabilities in the TCP three-way handshake process, where the server allocates resources for each incoming SYN packet. By sending a large number of SYN requests without completing the handshake, an attacker can exhaust the server's resources. Additionally, TCP does not inherently limit the number of SYN requests, further enabling this attack.
- A. Correct.
Correct. The TCP three-way handshake requires the server to allocate resources for each connection after receiving a SYN request, making it vulnerable to SYN flood attacks.
- B. Incorrect.
Incorrect. While IP spoofing may be used in conjunction with an attack, this vulnerability is not specific to the SYN flood attack or TCP.
- C. Correct.
Correct. TCP has no built-in mechanism to limit the number of SYN requests, allowing attackers to overwhelm a server by sending excessive SYN packets.
- D. Incorrect.
Incorrect. This statement describes UDP's characteristics, which are irrelevant to the TCP-specific SYN flood attack.
- E. Incorrect.
Incorrect. While TCP retransmission mechanisms could exacerbate resource issues, they are not directly exploited by a SYN flood attack.