hardMultiple SelectObjective-mapped
350-701 Practice Question: Which THREE of the following are common…
Which THREE of the following are common indicators of a DDoS attack at the network layer?
⚠ Common exam trap
Cisco often tests the distinction between network-layer (Layer 3/4) and application-layer (Layer 7) indicators, so candidates mistakenly choose 'unusual traffic on non-standard ports' as a network-layer indicator when it is actually a sign of application-layer attacks like HTTP floods or DNS amplification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A spike in UDP traffic to a single target
A spike in UDP traffic to a single target is a classic indicator of a UDP flood attack, a common network-layer DDoS. Attackers send a high volume of UDP packets, often to random ports, overwhelming the target's ability to process them and consuming bandwidth. This is a direct Layer 3/4 attack that does not require a completed handshake, making it easy to generate and hard to mitigate without proper filtering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A spike in UDP traffic to a single target
Why this is correct
UDP flood is a common network-layer DDoS.
- ✗
Unusual traffic on non-standard TCP/UDP ports
Why it's wrong here
This is more indicative of application-layer attacks.
- ✓
A high number of TCP SYN packets from multiple sources
Why this is correct
SYN flood is a common network-layer DDoS.
- ✗
High CPU usage on network devices
Why it's wrong here
While a symptom of DDoS, it is not a direct indicator of attack type.
- ✓
A sudden increase in ICMP echo request packets from many IPs
Why this is correct
ICMP flood is a common network-layer DDoS.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.