CS0-003 Security Operations Practice Question
During a network traffic analysis, a security analyst observes repeated TCP SYN packets sent to a host that responds with SYN-ACK, but the connection never completes. What type of anomaly is this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SYN flood
A half-open TCP handshake (SYN flood) is a common DoS technique where the attacker sends many SYN packets without completing the handshake, exhausting server resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS amplification
Why it's wrong here
DNS amplification is a Layer 7 Distributed Denial of Service (DDoS) attack that exploits open DNS resolvers to overwhelm a target with massive UDP responses. It relies on spoofing the victim's IP address to send small queries that yield disproportionately large payloads, which is fundamentally different from manipulating the TCP three-way handshake.
- ✓
SYN flood
Why this is correct
A SYN flood is a classic denial-of-service attack that exploits the TCP three-way handshake. The attacker floods the target with SYN packets using spoofed source IP addresses, forcing the victim to allocate resources and respond with SYN-ACKs, but never completes the connection with a final ACK. This rapidly exhausts the target's connection queue, preventing legitimate users from establishing connections.
- ✗
ARP spoofing
Why it's wrong here
ARP spoofing is a Layer 2 attack where an adversary sends falsified Address Resolution Protocol messages over a local area network. This associates the attacker's MAC address with the IP address of a legitimate server or gateway, enabling man-in-the-middle interception. It operates entirely at the data link layer and does not involve the generation of incomplete TCP connection states.
- ✗
Port scan
Why it's wrong here
While a TCP SYN port scan (half-open scanning) does send SYN packets to probe ports, its primary objective is reconnaissance across multiple ports or hosts rather than resource exhaustion. In contrast, a SYN flood targets a specific service port on a single host with high-volume, repetitive SYN packets designed to consume system memory and crash the service.
Visual reference
Go deeper
Related to this question
Learn chapter
Security SLAs and SLOs
Key term
Analysis
In incident response, analysis is the process of examining data and events to determine what happened, how it happened, and what actions to take.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.