N10-009 Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Implement SYN cookies on the server.

  Why this is correct

  SYN cookies are a highly effective defense against SYN floods because they allow the server to defer allocating memory for a new connection until the three-way handshake is fully completed. Instead of storing connection state, the server encodes all necessary information, such as client IP, port, and sequence numbers, into the initial SYN-ACK packet's sequence number. Only upon receiving a valid final ACK, which includes the correct cookie, does the server reconstruct the connection state and allocate resources, effectively preventing its connection table from being exhausted by spoofed or incomplete SYN requests.

• ✗

  Increase the server's TCP connection backlog.

  Why it's wrong here

  Increasing the server's TCP connection backlog merely expands the queue for half-open connections awaiting the final ACK. While this might slightly delay the point of exhaustion, it does not fundamentally alter the server's vulnerability to a sustained SYN flood. The server still dedicates finite memory and processing resources to each entry in that backlog, meaning a sufficiently large or prolonged attack will inevitably fill even an expanded queue, leading to service degradation.

  When this WOULD be correct

  This option would be correct in a scenario where the server is dropping legitimate connections due to a legitimate traffic spike (e.g., flash crowd) and the backlog is set too low, causing new connections to be rejected even though the server has capacity to handle them.

• ✗

  Enable bogon filtering on the perimeter firewall.

  Why it's wrong here

  Bogon filtering on a perimeter firewall blocks traffic originating from IP addresses that are reserved for private networks or are currently unallocated on the internet. While some SYN flood attacks utilize spoofed source IP addresses, many of these spoofed addresses are not bogons, rendering this defense largely ineffective against a sophisticated SYN flood. This technique primarily aims to prevent traffic from clearly invalid sources, not to mitigate resource exhaustion from a high volume of seemingly valid, yet malicious, connection attempts.

  When this WOULD be correct

  A company is receiving traffic from IP addresses that are known to be unallocated or reserved (e.g., private IPs on the internet). Enabling bogon filtering on the perimeter firewall would block this invalid traffic and protect the network.

• ✗

  Deploy an intrusion prevention system (IPS) with signature detection.

  Why it's wrong here

  Deploying an Intrusion Prevention System (IPS) with signature detection can identify and potentially block known SYN flood patterns. However, an IPS typically operates at a higher layer and requires more computational resources per packet than simpler network devices or server-side mitigations. In the face of a high-volume SYN flood, the IPS itself can become a bottleneck, struggling to process the immense traffic volume, leading to performance issues or even becoming overwhelmed before the attack traffic reaches the server.

  When this WOULD be correct

  An IPS with signature detection would be correct for blocking application-layer attacks, such as SQL injection or cross-site scripting, where the attack payload is in the data stream and can be matched against signatures.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question