312-50 Question 232
Single answer▪ DoS/DDoS Attack TechniquesDuring an authorized assessment, a security team observes that a public web application becomes unreachable whenever traffic spikes, but the upstream Internet link is not saturated. NetFlow and packet captures show a very high volume of TCP SYN packets from many spoofed IP addresses, very few completing the three-way handshake, and the load balancer's connection table filling rapidly. Which attack technique best explains this behavior?
- A
TCP SYN flood targeting the application's listening service
- B
Smurf attack using ICMP echo requests sent to a broadcast address
- C
UDP amplification attack against the organization's DNS resolver
- D
Slowloris attack holding many HTTP connections open with partial headers
Show answer and explanation
Correct answer: A
Explanation
The best answer is TCP SYN flood targeting the application's listening service. This is a classic state-exhaustion DoS technique in which attackers send many SYN packets and do not complete the TCP three-way handshake, leaving the server, firewall, or load balancer to maintain large numbers of half-open connections. The scenario's key indicators are: spoofed source addresses, a high volume of SYN packets, few completed handshakes, and exhaustion of the load balancer's connection table without the upstream link being fully saturated. These details distinguish a SYN flood from volumetric reflection/amplification attacks and from application-layer attacks such as Slowloris. In practice, defenders look for mitigations such as SYN cookies, increasing SYN backlog capacity where appropriate, connection rate limiting, upstream DDoS filtering, and load balancer or firewall protections for SYN proxying. This aligns with standard TCP behavior described in RFC 793 and common vendor guidance for mitigating SYN flood attacks.
- A. Correct.
Correct. A TCP SYN flood sends large numbers of SYN packets, often with spoofed source IP addresses, to create many half-open connections. The target allocates state for each pending connection and waits for the final ACK, which can exhaust the SYN backlog or connection table on a server or load balancer. The scenario specifically mentions many SYNs, few completed handshakes, spoofed sources, and a rapidly filling connection table without full link saturation, which is characteristic of a SYN flood.
- B. Incorrect.
Incorrect. A Smurf attack relies on sending ICMP echo requests to a network broadcast address with the victim's spoofed source IP, causing many hosts to reply to the victim. While this can create volumetric denial of service, the scenario points to TCP SYN packets and half-open connection exhaustion rather than ICMP echo reply amplification. Also, modern networks typically mitigate classic Smurf attacks by disabling directed broadcasts, making this less likely in a current enterprise environment.
- C. Incorrect.
Incorrect. A UDP amplification attack against DNS typically produces large volumes of UDP traffic, often from reflectors, and is intended to saturate bandwidth or overwhelm processing with amplified responses. The evidence here is not UDP-based and does not describe amplified DNS responses. Instead, it highlights incomplete TCP handshakes and state exhaustion on the load balancer, which aligns with SYN flooding rather than DNS amplification.
- D. Incorrect.
Incorrect. Slowloris is an application-layer denial-of-service technique that opens many HTTP connections and keeps them alive by sending partial headers slowly, tying up web server worker threads or connection pools. Although it can make a web application unavailable without saturating bandwidth, packet captures in a Slowloris case would show established TCP connections and incomplete HTTP requests, not a massive number of SYN packets with few handshakes completed.