N10-009 Network Security Practice Question
A network administrator notices that a large number of ICMP echo request packets are being sent to the broadcast address of the network from a single host. This is causing performance degradation. Which type of attack is this?
⚠ Common exam trap
CompTIA often tests the distinction between amplification attacks (smurf vs. DNS amplification) by focusing on the protocol used (ICMP vs. UDP) and the target address (broadcast vs. open resolver), leading candidates to confuse smurf with DNS amplification if they only remember 'amplification' without the protocol details.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Smurf attack
The smurf attack exploits ICMP by sending echo request packets to a network's broadcast address with a spoofed source IP of the victim. All hosts on the network then reply to the victim, overwhelming it with traffic and causing performance degradation. This matches the scenario of a single host sending ICMP echo requests to the broadcast address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ARP spoofing
Why it's wrong here
ARP spoofing is a man-in-the-middle (MITM) attack that manipulates the Address Resolution Protocol (ARP) to redirect network traffic. An attacker sends forged ARP messages to associate their MAC address with the IP address of a legitimate network device, such as a default gateway or another host. This causes traffic intended for the legitimate device to be sent to the attacker's machine instead, but it does not involve sending ICMP echo requests to broadcast addresses.
When this WOULD be correct
A network administrator notices that traffic intended for a legitimate server is being redirected to an attacker's machine, causing data interception. Which attack is this?
- ✗
MAC flooding
Why it's wrong here
MAC flooding attacks aim to overwhelm a network switch's Content Addressable Memory (CAM) table, also known as the MAC address table. By rapidly sending numerous Ethernet frames with unique, spoofed source MAC addresses, the attacker fills the switch's limited CAM table capacity. Once the table is full, the switch enters a fail-open mode, effectively behaving like an old hub by broadcasting all incoming frames out of every port, compromising network security by allowing traffic sniffing, but without using ICMP echo requests.
When this WOULD be correct
A network administrator notices that the switch is flooding frames to all ports and the CAM table is full. Which type of attack is this?
- ✓
Smurf attack
Why this is correct
A Smurf attack is a classic denial-of-service (DoS) technique that leverages ICMP echo requests to overwhelm a target. Attackers send a large number of ICMP echo request packets to a network's broadcast address, spoofing the source IP address to be that of the victim. All hosts on the broadcast domain then respond to the victim's spoofed IP with ICMP echo replies, creating a massive flood of traffic that saturates the target's network bandwidth and processing capabilities, leading to a DoS.
- ✗
DNS amplification
Why it's wrong here
DNS amplification is a distributed denial-of-service (DDoS) attack that exploits open DNS resolvers to magnify the volume of malicious traffic directed at a target. Attackers send small DNS queries with a spoofed source IP address (the victim's) to numerous open DNS servers, which then reply with much larger responses to the victim. This creates a significant traffic flood that can overwhelm the target, but the mechanism relies on DNS queries and responses, not ICMP echo requests to broadcast addresses.
When this WOULD be correct
This option would be correct in a question describing a high volume of DNS queries with spoofed source IPs sent to open resolvers, causing large responses to overwhelm the victim.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Smurf attackCorrect answer▾
Why this is correct
A Smurf attack is a classic denial-of-service (DoS) technique that leverages ICMP echo requests to overwhelm a target. Attackers send a large number of ICMP echo request packets to a network's broadcast address, spoofing the source IP address to be that of the victim. All hosts on the broadcast domain then respond to the victim's spoofed IP with ICMP echo replies, creating a massive flood of traffic that saturates the target's network bandwidth and processing capabilities, leading to a DoS.
✗ARP spoofingWrong answer — click to see why▾
Why this is wrong here
The attack described involves ICMP echo requests to a broadcast address, which is characteristic of a Smurf attack, not ARP spoofing. ARP spoofing involves sending falsified ARP messages to associate the attacker's MAC address with the IP of a legitimate host, enabling man-in-the-middle attacks.
★ When this WOULD be the correct answer
A network administrator notices that traffic intended for a legitimate server is being redirected to an attacker's machine, causing data interception. Which attack is this?
Why candidates choose this
Candidates may confuse ARP spoofing with any attack that causes performance degradation, or they may not clearly distinguish between attacks that use broadcast traffic versus those that manipulate address resolution.
✗MAC floodingWrong answer — click to see why▾
Why this is wrong here
MAC flooding targets switch MAC address tables by sending many frames with different source MAC addresses, not by sending ICMP echo requests to a broadcast address.
★ When this WOULD be the correct answer
A network administrator notices that the switch is flooding frames to all ports and the CAM table is full. Which type of attack is this?
Why candidates choose this
Candidates may confuse 'flooding' in the question with MAC flooding, not realizing that the attack described uses ICMP and broadcast addresses, not MAC address table exhaustion.
✗DNS amplificationWrong answer — click to see why▾
Why this is wrong here
A DNS amplification attack uses open DNS servers to flood a target with large DNS responses, not ICMP echo requests to a broadcast address.
★ When this WOULD be the correct answer
This option would be correct in a question describing a high volume of DNS queries with spoofed source IPs sent to open resolvers, causing large responses to overwhelm the victim.
Why candidates choose this
Candidates may confuse amplification attacks (like DNS amplification) with the smurf attack because both involve amplifying traffic to overwhelm a target, but they use different protocols and mechanisms.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
ICMP
ICMP is a network protocol used by devices to send error messages and operational information about network communication problems.
Key term
ICMP
ICMP is a network-layer protocol used by network devices to send error messages and operational information about network connectivity.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.