200-201 Question 277
Single answerDuring an intrusion analysis, a security analyst notices unusual traffic originating from a specific IP address to a high-numbered port on a remote server. Upon inspecting the protocol headers, the analyst observes the TCP header with the SYN flag set and no subsequent ACK. What does this likely indicate?
- A
A TCP three-way handshake in progress
- B
A SYN flood attack
- C
Normal web browsing activity
- D
A UDP flood attack
Show answer and explanation
Correct answer: B
Explanation
The scenario describes the repeated observation of SYN packets without the corresponding ACK packets. This behavior is characteristic of a SYN flood attack, a type of denial-of-service (DoS) attack where the attacker sends numerous SYN packets to a target to overwhelm its resources and disrupt legitimate connections. Understanding TCP header flags and their use in identifying such attacks is critical for effective intrusion analysis.
- A. Incorrect.
Incorrect: A TCP three-way handshake involves the SYN, SYN-ACK, and ACK flags. In this scenario, only the SYN flag is set with no subsequent ACK, which is not indicative of a handshake in progress.
- B. Correct.
Correct: A SYN flood attack involves sending numerous SYN packets without completing the handshake, as described in the scenario. This can be used to exhaust server resources or probe for vulnerabilities.
- C. Incorrect.
Incorrect: Normal web browsing activity would involve completed TCP handshakes and data transmission, not just SYN packets with no ACK.
- D. Incorrect.
Incorrect: A UDP flood attack involves flooding a target with UDP packets, not TCP SYN packets, which are specific to the TCP protocol.