SY0-701 Question 114
Single answerA company hosts a public web application in its data center. During several outages, the security team observes a massive spike in inbound UDP traffic to the internet-facing load balancer. Packet captures show most of the traffic is DNS responses from many legitimate external DNS servers, but the company never sent corresponding DNS queries to those servers. The source IP in the original queries appears to have been spoofed as the company’s public IP address. Which attack best explains this activity?
- A
An amplified and reflected DDoS attack using DNS servers
- B
An on-path attack intercepting and modifying DNS traffic between clients and the web server
- C
A credential replay attack against the load balancer’s administrative interface
- D
A wireless deauthentication attack disrupting employee access to the internal network
Show answer and explanation
Correct answer: A
Explanation
The best answer is an amplified and reflected DDoS attack using DNS servers. In a DNS reflection attack, the attacker sends DNS queries to publicly reachable resolvers with the victim’s IP address spoofed as the source. Because DNS commonly uses UDP, the responder sends replies without validating the sender, causing the DNS servers to reflect traffic toward the victim. Amplification occurs when small queries trigger much larger responses, especially with records or request types that produce large payloads. This combination can overwhelm bandwidth or infrastructure.
This scenario specifically rules in reflection/amplification because: (1) the traffic consists of DNS responses rather than requests, (2) the DNS servers are legitimate third-party systems, (3) the victim did not initiate the related queries, and (4) spoofed source IPs were used in the original requests. These are standard indicators discussed in DDoS guidance from organizations such as CISA and in best-practice anti-spoofing recommendations like BCP 38 / RFC 2827 and BCP 84 / RFC 3704. Defensive measures include working with upstream providers or DDoS mitigation services, rate limiting where appropriate, hardening DNS infrastructure, and preventing source address spoofing through ingress/egress filtering.
- A. Correct.
Correct. This is the classic pattern of a DNS reflection/amplification DDoS attack. The attacker sends spoofed DNS queries to open or misconfigured DNS resolvers, using the victim’s IP address as the spoofed source. Those DNS servers then send large DNS responses to the victim, reflecting the traffic off legitimate servers and amplifying the volume. The clues are unsolicited DNS responses, many legitimate DNS servers as apparent senders, UDP traffic spikes, and spoofed source IP addresses in the original requests.
- B. Incorrect.
Incorrect. An on-path attack involves an attacker positioning themselves between communicating parties to intercept, observe, or alter traffic. In this scenario, there is no indication that traffic is being modified in transit between clients and the company. Instead, the company is receiving unsolicited DNS responses from third-party DNS servers, which is characteristic of reflection/amplification rather than interception.
- C. Incorrect.
Incorrect. A credential replay attack involves capturing valid authentication material, such as session tokens, NTLM handshakes, or Kerberos tickets, and reusing it to gain unauthorized access. That type of attack would target authentication workflows, not create a large flood of inbound UDP DNS response traffic from many external DNS servers.
- D. Incorrect.
Incorrect. A wireless deauthentication attack targets Wi-Fi clients by sending forged deauth frames to disconnect them from an access point. That would affect wireless availability locally and would not explain a flood of inbound internet DNS response traffic striking a public-facing load balancer.