200-201 Question 287
Single answerYou are analyzing traffic in a network monitoring tool and notice a consistent stream of UDP packets being sent to random destination ports from a single source IP address. How should this behavior be interpreted in the context of cybersecurity operations?
- A
This is normal behavior for UDP-based services like DNS and DHCP.
- B
This could be an indication of a UDP flood attack aimed at overwhelming the target system.
- C
This behavior is likely caused by legitimate applications using dynamic ports for communication.
- D
This might indicate a reconnaissance attempt to identify open UDP ports on the target.
Show answer and explanation
Correct answer: B
Explanation
The consistent stream of UDP packets to random ports is a characteristic of a UDP flood attack. This type of attack is often used to exhaust network or system resources. While UDP is commonly used in legitimate communications, such as DNS and DHCP, this specific behavior is not typical of normal application or service traffic.
- A. Incorrect.
UDP-based services like DNS and DHCP do use UDP, but their behavior does not involve sending packets to random ports from a single source IP address.
- B. Correct.
A consistent stream of UDP packets sent to random ports suggests a UDP flood attack, which is a common type of Distributed Denial of Service (DDoS) attack designed to overwhelm the target with high traffic.
- C. Incorrect.
Legitimate applications using dynamic ports typically communicate in established patterns, not by sending packets to random ports.
- D. Incorrect.
While reconnaissance could involve UDP traffic, it usually involves sending packets to specific ports to detect open services, not random ports.