N10-009 Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  DNS amplification attack

  Why it's wrong here

  A DNS amplification attack is a type of distributed denial-of-service (DDoS) attack that leverages open DNS resolvers to flood a target with large volumes of UDP response traffic. Attackers send small DNS queries with a spoofed source IP (the victim's) to numerous DNS servers, which then reply with much larger responses to the victim. Firewall logs would primarily show a high volume of incoming UDP DNS responses, not a flood of TCP SYN packets, as the attack vector is entirely different.

  When this WOULD be correct

  A DNS amplification attack would be correct if the question described a high volume of large DNS response packets (e.g., from open resolvers) directed at a target, with the source IPs being spoofed DNS servers, and the goal being bandwidth exhaustion.

• ✓

  SYN flood attack

  Why this is correct

  A SYN flood attack exploits the TCP three-way handshake by sending numerous SYN requests to a target server without completing the final ACK. This leaves the server with many half-open connections, rapidly consuming its connection table resources and memory. The firewall logs would precisely reflect this by showing thousands of incoming SYN packets, often from spoofed source IPs, indicating a denial-of-service attempt.

• ✗

  ARP spoofing attack

  Why it's wrong here

  ARP spoofing is a Layer 2 attack where an attacker sends forged Address Resolution Protocol (ARP) messages to a local area network. This manipulates the MAC address-to-IP address mappings in device ARP caches, redirecting traffic through the attacker's machine. Such an attack would primarily generate ARP traffic, not a flood of TCP SYN packets visible in firewall logs, as its goal is traffic interception, not connection exhaustion.

  When this WOULD be correct

  A network administrator notices intermittent connectivity issues and, upon checking ARP tables, finds multiple IP addresses mapped to the same MAC address. Which attack is most likely occurring?

• ✗

  Man-in-the-middle attack

  Why it's wrong here

  A Man-in-the-Middle (MITM) attack involves an attacker secretly relaying and possibly altering the communication between two parties who believe they are directly communicating. While a MITM attacker intercepts network traffic, the primary objective is eavesdropping, data manipulation, or session hijacking, not overwhelming a server with connection requests. Therefore, firewall logs would not typically show a massive influx of SYN packets originating from many different sources as a characteristic signature of this type of attack.

  When this WOULD be correct

  A man-in-the-middle attack would be correct in a scenario where an attacker intercepts traffic between a client and server, for example, by ARP spoofing to redirect traffic through the attacker's machine, allowing eavesdropping or data modification. The question would describe suspicious traffic patterns like ARP replies or session hijacking.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”