200-201 Question 288
Select 3A cybersecurity analyst is investigating unusual traffic on the network. They observe a significant number of packets being sent to a single port on multiple devices, but these packets do not establish any connection. The analyst suspects this could be a UDP-based attack. Which of the following characteristics of UDP traffic should the analyst consider to support their assessment?
- A
UDP is connectionless and does not require a handshake.
- B
UDP is reliable and ensures packet delivery through acknowledgments.
- C
UDP is prone to spoofing due to the lack of session establishment.
- D
UDP is slower than TCP because it waits for acknowledgments.
- E
UDP is commonly used in amplification attacks due to its design.
Show answer and explanation
Correct answers: A, C, E
Explanation
The analyst should focus on the characteristics of UDP that make it suitable for malicious purposes. UDP's connectionless nature, susceptibility to spoofing, and use in amplification attacks align with the observed traffic behavior. These properties make it a common protocol exploited in various types of network attacks.
- A. Correct.
Correct: UDP is connectionless, which means it does not establish a session or perform a handshake like TCP. This makes it easier to send packets without verification, which aligns with the behavior observed.
- B. Incorrect.
Incorrect: UDP is not reliable and does not provide acknowledgments for packet delivery. This characteristic differentiates it from TCP.
- C. Correct.
Correct: The lack of session establishment in UDP makes it susceptible to spoofing attacks, where the source IP address can be easily forged.
- D. Incorrect.
Incorrect: UDP is typically faster than TCP because it does not wait for acknowledgments or establish a connection.
- E. Correct.
Correct: UDP's design allows it to be leveraged in amplification attacks, where a small request can result in a large response, overwhelming the target.