Detailed Explanations for Questions 251-270
Q251. What year did the Ping of Death first appear?
- A. 1992
- B. 1989
- C. 1990
- D. 1996 ✓
Why D is correct: The Ping of Death vulnerability was publicly disclosed and became widely known in 1996. It involved sending malformed or oversized ICMP packets (larger than the maximum 65,535 bytes allowed by the IP protocol), which, when reassembled by the target system, caused buffer overflows, system crashes, or reboots.
Why others are incorrect:
- A, B, C: These years predate the widespread recognition and exploitation of the Ping of Death vulnerability. While some underlying protocol weaknesses may have existed earlier, 1996 is the recognized year for this specific attack’s emergence.
Q252. Which is the best example of a denial-of-service (DoS) attack?
- A. A victim’s computer is infected with a virus.
- B. A misconfigured switch is in a switching loop.
- C. An adversary is forging a certificate.
- D. An adversary is consuming all available memory of a target system by opening as many “half-open” connections on a web server as possible. ✓
Why D is correct: A Denial-of-Service (DoS) attack aims to make a machine or network resource unavailable to its intended users. Consuming all available memory or connection slots (like in a SYN flood with half-open connections) directly prevents legitimate users from accessing the service, which is the definition of DoS.
Why others are incorrect:
- A: A virus infection is malware; while it might cause performance issues, its primary goal is often replication, data theft, or damage, not necessarily denying service to others.
- B: A switching loop is a network configuration error, not a malicious attack by an adversary.
- C: Forging a certificate is related to authentication spoofing or Man-in-the-Middle attacks, not directly denying service availability.
Q253. Which type of packet does a Fraggle attack use to create a DoS attack?
- A. TCP
- B. IP
- C. ICMP
- D. UDP ✓
Why D is correct: A Fraggle attack is similar to a Smurf attack but uses UDP packets instead of ICMP. The attacker sends spoofed UDP packets to a broadcast address, causing all hosts on that network to reply to the victim, amplifying the traffic and causing a DoS.
Why others are incorrect:
- A: TCP is connection-oriented and not typically used for amplification attacks like Fraggle.
- B: IP is the network layer protocol; Fraggle specifically exploits the Transport layer protocol UDP.
- C: ICMP is used in Smurf attacks, not Fraggle attacks.
Q254. Which of the following denial-of-service attacks would be most likely to be successful today?
- A. Fraggle
- B. Smurf
- C. Slowloris ✓
- D. None of the above
Why C is correct: Slowloris is an application-layer DoS attack that holds connections open by sending partial HTTP requests. It requires very little bandwidth from the attacker but can tie up all available connections on a web server. Unlike Smurf or Fraggle, it doesn’t rely on broadcast amplification (which is largely blocked by ISPs now), making it more viable against modern, unpatched web servers.
Why others are incorrect:
- A: Fraggle attacks rely on UDP broadcast amplification, which is mostly mitigated by modern network configurations (blocking directed broadcasts).
- B: Smurf attacks rely on ICMP broadcast amplification, which is also largely mitigated by modern routers and firewalls.
- D: Slowloris remains a viable threat against specific targets, so “None of the above” is incorrect.
Q255. What is a network of zombie computers used to execute a DDoS on a target system called?
- A. Botnet ✓
- B. Whaling
- C. Social engineering
- D. DoS
Why A is correct: A Botnet is a collection of internet-connected devices (zombies) infected with malware and controlled by a single attacker (bot herder). Botnets are commonly used to launch Distributed Denial-of-Service (DDoS) attacks by coordinating traffic from many sources simultaneously.
Why others are incorrect:
- B: Whaling is a type of spear phishing attack targeting high-profile executives.
- C: Social engineering involves manipulating people, not a network of computers.
- D: DoS (Denial-of-Service) is the type of attack, not the name of the network of computers used to launch it.
Q256. You are a security administrator working at a movie production company. One of your daily duties is to check the IDS logs when you are alerted. You notice that you received a lot of incomplete three-way handshakes, your memory performance has been dropping significantly on your web server, and customers are complaining of really slow connections. What could be the actual issue?
- A. DoS
- B. DDoS
- C. Smurf attack
- D. SYN flood ✓
Why D is correct: The symptoms described—incomplete three-way handshakes (SYN without ACK), dropping memory performance, and slow connections—are classic indicators of a SYN flood attack. The attacker sends many SYN requests but never completes the handshake, exhausting server resources.
Why others are incorrect:
- A: DoS is the general category, but SYN flood is the specific technique described by the “incomplete handshakes.”
- B: DDoS implies multiple sources; while possible, the specific symptom of incomplete handshakes points directly to the SYN flood mechanism regardless of source count.
- C: A Smurf attack uses ICMP echo requests, not TCP handshakes.
Q257. You are an administrator overseeing IT security operations for a local bank. As you review logs from the prior day, you notice a very high rate of UDP packets targeting your web server that are coming from your clients all at the same time. What could be the culprit?
- A. Smurf attack
- B. DDoS
- C. SYN flood attack
- D. Fraggle attack ✓
Why D is correct: A Fraggle attack specifically involves a high volume of UDP packets sent to a broadcast address (or appearing to come from many sources due to amplification), targeting a victim. The mention of UDP packets targeting the server aligns with the Fraggle methodology.
Why others are incorrect:
- A: Smurf attacks use ICMP packets, not UDP.
- B: DDoS is a broad category; while this is likely a DDoS, Fraggle is the specific type described by the UDP traffic pattern.
- C: SYN flood attacks use TCP packets (SYN flags), not UDP.
Q258. Which of the following attacks sends fragmented UDP packets to a Windows system using port 53 or other UDP ports that may cause the system to crash?
- A. Fraggle
- B. Bonk ✓
- C. Smash the stack
- D. Smurf
Why B is correct: The Bonk attack involves sending oversized or fragmented UDP packets (often targeting port 53/DNS) to a system. When the system attempts to reassemble these malformed packets, it can cause a crash or reboot, particularly on older Windows systems.
Why others are incorrect:
- A: Fraggle uses UDP for amplification via broadcast, not specifically fragmentation to crash a single host via reassembly issues.
- C: “Smash the stack” refers to stack smashing/buffer overflow, not specifically fragmented UDP packets.
- D: Smurf uses ICMP, not UDP.
Q259. Which of the following attacks uses UDP packets to target the broadcast address and cause a DDoS?
- A. Smurf
- B. Fraggle ✓
- C. Land
- D. Teardrop
Why B is correct: The Fraggle attack is defined by sending spoofed UDP packets to a network’s broadcast address. This causes all devices on that network to reply to the spoofed source IP (the victim), creating a DDoS effect.
Why others are incorrect:
- A: Smurf attacks use ICMP packets, not UDP.
- C: A Land attack sends a packet with the source and destination IP/port set to the same victim’s address, causing a loop, not broadcast amplification.
- D: Teardrop attacks exploit IP fragmentation reassembly, not broadcast amplification.
Q260. What type of attack is a Fraggle attack?
- A. XML entity
- B. False error
- C. Fragmentation
- D. Amplification ✓
Why D is correct: Fraggle is an amplification attack. By sending a small packet to a broadcast address, the attacker triggers many larger responses from the network’s hosts, amplifying the traffic volume directed at the victim.
Why others are incorrect:
- A: XML entity attacks (XXE) target web applications parsing XML, not network layer DoS.
- B: “False error” is not a standard classification for DoS attacks.
- C: While fragmentation might be involved in some packet crafting, the defining characteristic of Fraggle is traffic amplification.
Q261. Which tool causes sockets to be used up and can cause services to freeze or crash?
- A. Nmap
- B. Slowloris ✓
- C. Cain & Abel
- D. John the Ripper
Why B is correct: Slowloris is designed to tie up all available sockets on a web server by opening many connections and keeping them open as long as possible with minimal traffic (partial HTTP headers). This exhausts the server’s connection pool, causing legitimate requests to be denied.
Why others are incorrect:
- A: Nmap is a network scanner used for discovery and auditing, not for exhausting server sockets.
- C: Cain & Abel is a password recovery and sniffing tool.
- D: John the Ripper is a password-cracking tool.
Q262. Which of the following tools can be used to DDoS a target system?
- A. LOIC ✓
- B. SIMM
- C. Cain & Abel
- D. AOL Punter
Why A is correct: LOIC (Low Orbit Ion Cannon) is a well-known network stress testing application that can be used to perform DoS/DDoS attacks by flooding a target with TCP, UDP, or HTTP requests.
Why others are incorrect:
- B: SIMM refers to a type of computer memory module (Single In-line Memory Module), not a hacking tool.
- C: Cain & Abel is used for password cracking and sniffing, not DDoS.
- D: AOL Punter is not a recognized security or DDoS tool.
Q263. As a black hat, you are targeting a server room that contains important data. Which unconventional method would you use to DoS the entire room?
- A. Target the routers by DDoS.
- B. Conduct a Fraggle attack on the servers.
- C. Target the HVAC units. ✓
- D. Change all the administrator login information.
Why C is correct: Targeting HVAC (Heating, Ventilation, and Air Conditioning) units is a physical DoS attack. Server rooms require strict temperature control; disabling cooling can cause servers to overheat and shut down automatically to prevent damage, effectively denying service.
Why others are incorrect:
- A: Targeting routers is a standard network DDoS, not an “unconventional” physical method.
- B: Fraggle is a network-layer attack, not physical.
- D: Changing login information locks users out (availability issue) but doesn’t physically DoS the room’s hardware like HVAC manipulation does.
Q264. A method that defends against a flooding attack and massive DoS attacks is referred to as what?
- A. Defense in depth
- B. Spam blocker
- C. Flood safe
- D. Flood guard ✓
Why D is correct: A Flood Guard is a specific security feature or device configuration designed to detect and mitigate flooding attacks (like SYN floods or UDP floods) by limiting the rate of incoming connections or packets.
Why others are incorrect:
- A: Defense in depth is a broad security strategy involving multiple layers, not a specific tool for flooding.
- B: Spam blockers target email spam, not network flooding attacks.
- C: “Flood safe” is not a standard industry term for DoS mitigation technology.
Q265. Which of the following denial-of-service attacks would be most likely to be successful today?
- A. Fraggle
- B. Smurf
- C. Slowloris ✓
- D. None of the above
(Duplicate of Q254) Why C is correct: Slowloris remains effective against web servers that do not have specific modules or configurations to limit connection durations or numbers per IP. Older amplification attacks like Smurf and Fraggle are largely mitigated by ISP-level filtering of broadcast traffic.
Why others are incorrect:
- A & B: Broadcast amplification attacks are largely blocked by modern network infrastructure.
- D: Slowloris is still a valid threat.
Q266. What is a network of zombie computers used to execute a DDoS on a target system called?
- A. Botnet ✓
- B. Whaling
- C. Social engineering
- D. DoS
(Duplicate of Q255) Why A is correct: A Botnet consists of compromised systems (zombies) controlled remotely to launch coordinated attacks like DDoS.
Why others are incorrect:
- B, C, D: These refer to phishing, human manipulation, and the attack type itself, not the network of compromised machines.
Q267. Which type of network uses a group of zombie computers to carry out the commands of the bot master?
- A. Zombie net
- B. Zombie group
- C. Botnet ✓
- D. Bot heard
Why C is correct: “Botnet” is the standard terminology for a network of bots (zombie computers) under the control of a bot master.
Why others are incorrect:
- A, B, D: These are made-up terms or variations that are not the standard industry terminology.
Q268. Which of the following is the best example of a denial-of-service (DoS) attack?
- A. A victim’s computer is infected with a virus.
- B. A misconfigured switch is in a switching loop.
- C. An adversary is forging a certificate.
- D. An adversary is consuming all available memory of a target system by opening as many “half-open” connections on a web server as possible. ✓
(Duplicate of Q252) Why D is correct: This describes the mechanism of resource exhaustion, which is the core principle of a DoS attack.
Why others are incorrect:
- A, B, C: These describe malware infection, configuration errors, and authentication spoofing, respectively, not DoS.
Q269. What year did the Ping of Death first appear?
- A. 1992
- B. 1989
- C. 1990
- D. 1996 ✓
(Duplicate of Q251) Why D is correct: 1996 is the historically accepted year for the emergence of the Ping of Death attack.
Why others are incorrect:
- A, B, C: Incorrect historical dates for this specific vulnerability.
Q270. Which type of packet does a Fraggle attack use to create a DoS attack?
- A. TCP
- B. IP
- C. ICMP
- D. UDP ✓
(Duplicate of Q253) Why D is correct: Fraggle attacks specifically utilize UDP packets for amplification.
Why others are incorrect:
- A, B, C: Fraggle does not use TCP or ICMP (Smurf uses ICMP). IP is the underlying protocol but UDP is the specific transport protocol exploited.
Key Takeaways for Module 10: Denial-of-Service
- Attack Types: Understand the differences between SYN Flood (TCP half-open), Smurf (ICMP amplification), Fraggle (UDP amplification), Ping of Death (oversized ICMP), and Slowloris (HTTP connection exhaustion).
- Botnets: A Botnet is the infrastructure of zombie computers used for DDoS.
- Modern Viability: Slowloris is more likely to succeed today than Smurf/Fraggle because modern networks block directed broadcasts.
- Physical DoS: DoS isn’t just digital; targeting HVAC or power can physically deny service.
- Defenses: Flood Guards, rate limiting, and proper firewall configuration are key defenses.
- Tools: LOIC is a known DDoS tool; Slowloris is a specific tool for web server exhaustion.
- Protocols: Know which protocol each attack uses (Smurf=ICMP, Fraggle=UDP, SYN Flood=TCP).
