100-160 Question 58
Single answerDuring a network security assessment, a cybersecurity technician identifies that an attacker exploited a vulnerability in the TCP three-way handshake to flood a server with half-open connections, causing service disruption. Which TCP/IP protocol vulnerability did the attacker exploit?
- A
IP Address Spoofing
- B
SYN Flood Attack
- C
Session Hijacking
- D
DNS Cache Poisoning
Show answer and explanation
Correct answer: B
Explanation
The TCP three-way handshake is critical for establishing connections between clients and servers. A SYN Flood Attack exploits this process by sending a large number of SYN requests to the server without completing the handshake, leaving resources allocated for incomplete connections. This disrupts normal server operations, making it unavailable to legitimate users.
- A. Incorrect.
IP Address Spoofing involves forging the source IP address to disguise the sender's identity, but it does not directly relate to the exploitation of the TCP three-way handshake.
- B. Correct.
SYN Flood Attack exploits the TCP three-way handshake by sending a large number of SYN packets to a server without completing the handshake, leading to resource exhaustion and service disruption.
- C. Incorrect.
Session Hijacking involves taking over an active session by stealing or predicting session tokens, but it does not involve exploiting the TCP three-way handshake.
- D. Incorrect.
DNS Cache Poisoning corrupts the DNS cache to redirect users to malicious websites, and it is unrelated to the TCP three-way handshake.