mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: An analyst examines a PCAP file and sees multiple…
An analyst examines a PCAP file and sees multiple packets with the same source IP, destination port 443, and a payload that starts with 'GET /login.php HTTP/1.1'. The packets occur in rapid succession with slight variations in the URL parameter. Which type of attack is most likely occurring?
⚠ Common exam trap
Cisco often tests the distinction between application-layer DDoS attacks (like HTTP floods) and protocol-specific attacks (like SSL/TLS renegotiation or DNS amplification), where candidates mistakenly associate any attack on port 443 with SSL/TLS issues rather than recognizing the HTTP payload as the key indicator.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HTTP flood DDoS attack
The attack involves multiple packets with the same source IP, all targeting destination port 443 with HTTP GET requests to '/login.php'. The rapid succession and slight variations in URL parameters indicate an attempt to overwhelm the web server with legitimate-looking HTTP requests, which is characteristic of an HTTP flood DDoS attack. This attack exploits the application layer (Layer 7) by exhausting server resources through repeated HTTP requests, rather than exploiting SSL/TLS or network-layer vulnerabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSL/TLS renegotiation attack
Why it's wrong here
This attack involves SSL renegotiation, not HTTP GET requests.
- ✓
HTTP flood DDoS attack
Why this is correct
Rapid HTTP requests with variations are characteristic of HTTP flood.
- ✗
DNS amplification
Why it's wrong here
DNS amplification attacks use UDP reflection from open resolvers to flood a victim with large responses, but the PCAP shows TCP traffic to port 443 with HTTP GET requests, not DNS queries. This option tempts because amplification attacks also involve high packet volume, but the correct scenario would require source IP spoofing and a DNS server responding with oversized replies, not repeated application-layer login attempts.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning is a local network attack at Layer 2.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.