Security Monitoring →easyMultiple ChoiceObjective-mapped

200-201 Security Monitoring Practice Question

An analyst is monitoring network traffic and sees a large number of TCP SYN packets sent to various ports on a single host from the same source IP. Which type of attack is most likely occurring?

⚠ Common exam trap

Cisco often tests the distinction between a port scan (reconnaissance, multiple ports) and a SYN flood (DoS, single port with high volume), so the trap here is confusing the reconnaissance technique of scanning many ports with the denial-of-service technique of overwhelming a single service.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Port scan

A port scan involves an attacker sending TCP SYN packets to multiple ports on a target host to determine which ports are open and listening. The key indicator is the single source IP targeting various ports on a single host, which matches the behavior of a SYN scan (half-open scan) used to map services without completing the full TCP three-way handshake.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
DNS amplification
Why it's wrong here
DNS amplification uses DNS responses, not TCP SYN.
✗
ARP poisoning
Why it's wrong here
ARP poisoning manipulates ARP tables, not TCP SYN packets.
✓
Port scan
Why this is correct
Port scan involves sending packets to many ports to discover open services.
✗
SYN flood
Why it's wrong here
SYN flood typically targets a single port to exhaust resources.

Visual reference

Go deeper

200-201 Security Monitoring Practice Question

Why each option matters

Option-by-option breakdown

Related to this question