N10-009 Network Security Practice Question
A security analyst is investigating a network anomaly. The analyst notices that the company's web server is receiving a large number of TCP SYN packets from random source IP addresses, all destined for port 80. The web server is responding with SYN-ACK packets, but the connections are never completed. This is causing the server's connection table to fill up, degrading performance for legitimate users. Which type of attack is being described?
⚠ Common exam trap
Candidates often confuse a SYN flood with a Smurf attack or DNS amplification because all three are volumetric DoS attacks, but the key differentiator is the protocol and mechanism: SYN flood uses TCP SYN packets targeting the three-way handshake, while Smurf uses ICMP and DNS amplification uses UDP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SYN flood
The attack described is a SYN flood, a type of denial-of-service (DoS) attack that exploits the TCP three-way handshake. The attacker sends a high volume of TCP SYN packets with spoofed source IP addresses to the server's port 80. The server responds with SYN-ACK packets to each spoofed source and waits for the final ACK, which never arrives, causing the server's half-open connection table (backlog queue) to fill up and exhaust resources, degrading performance for legitimate users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ping of death
Why it's wrong here
The Ping of Death attack involves sending an ICMP echo request packet that is larger than the maximum allowed IP packet size (65,535 bytes) after fragmentation. When the target system attempts to reassemble these oversized fragments, it can lead to a buffer overflow. This vulnerability, primarily affecting older operating systems, would cause the system to crash, reboot, or freeze, rather than targeting TCP connection states.
When this WOULD be correct
This would be correct in a question describing a system crashing due to receiving an IP packet larger than 65,535 bytes, typically via ICMP echo request (ping).
- ✗
Smurf attack
Why it's wrong here
A Smurf attack is a distributed denial-of-service technique that leverages an intermediary network's broadcast address. The attacker sends ICMP echo requests with the victim's spoofed IP address as the source to a network's broadcast address. All hosts on that network then reply to the victim, flooding their network with ICMP echo replies and consuming significant bandwidth.
When this WOULD be correct
A Smurf attack would be correct if the question described a network anomaly where the victim receives a large volume of ICMP echo reply packets from multiple hosts, triggered by an attacker sending ICMP echo requests to a broadcast address with the victim's spoofed source IP.
- ✓
SYN flood
Why this is correct
A SYN flood is a denial-of-service attack that exploits the TCP three-way handshake. The attacker sends numerous TCP SYN requests to a target server, often with spoofed source IP addresses. The server responds with SYN-ACK packets and allocates resources for each half-open connection, but never receives the final ACK, eventually exhausting its connection table and preventing legitimate users from connecting.
- ✗
DNS amplification
Why it's wrong here
DNS amplification is a reflection-based DDoS attack that exploits open DNS resolvers to magnify traffic directed at a victim. The attacker sends small DNS queries with the victim's spoofed IP address to numerous vulnerable DNS servers. These servers then respond with much larger DNS replies, overwhelming the victim's network bandwidth with amplified UDP traffic.
When this WOULD be correct
A question describes a network anomaly where the company's DNS server is receiving a high volume of small DNS queries from spoofed source IPs, and the server's responses are much larger, overwhelming the target's bandwidth. The attack uses open resolvers to amplify traffic.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓SYN floodCorrect answer▾
Why this is correct
A SYN flood is a denial-of-service attack that exploits the TCP three-way handshake. The attacker sends numerous TCP SYN requests to a target server, often with spoofed source IP addresses. The server responds with SYN-ACK packets and allocates resources for each half-open connection, but never receives the final ACK, eventually exhausting its connection table and preventing legitimate users from connecting.
✗Ping of deathWrong answer — click to see why▾
Why this is wrong here
A ping of death involves sending oversized or malformed ICMP packets to crash a system, not TCP SYN packets to fill a connection table.
★ When this WOULD be the correct answer
This would be correct in a question describing a system crashing due to receiving an IP packet larger than 65,535 bytes, typically via ICMP echo request (ping).
Why candidates choose this
Candidates may confuse any attack that degrades performance with 'ping of death' because both involve network flooding, but the specific TCP SYN behavior distinguishes a SYN flood.
✗Smurf attackWrong answer — click to see why▾
Why this is wrong here
A Smurf attack uses ICMP echo requests sent to a broadcast address with a spoofed source IP, causing all hosts on the network to reply to the victim. This question describes TCP SYN packets to a single server, not ICMP traffic to a broadcast address.
★ When this WOULD be the correct answer
A Smurf attack would be correct if the question described a network anomaly where the victim receives a large volume of ICMP echo reply packets from multiple hosts, triggered by an attacker sending ICMP echo requests to a broadcast address with the victim's spoofed source IP.
Why candidates choose this
Candidates may confuse the amplification effect of a Smurf attack with the resource exhaustion of a SYN flood, or mistakenly think any attack using spoofed IPs and overwhelming a server is a Smurf attack.
✗DNS amplificationWrong answer — click to see why▾
Why this is wrong here
DNS amplification attacks use open DNS resolvers to flood a target with large DNS response traffic, not TCP SYN packets to a web server's port 80.
★ When this WOULD be the correct answer
A question describes a network anomaly where the company's DNS server is receiving a high volume of small DNS queries from spoofed source IPs, and the server's responses are much larger, overwhelming the target's bandwidth. The attack uses open resolvers to amplify traffic.
Why candidates choose this
Candidates may confuse amplification attacks (which also involve spoofed sources and resource exhaustion) with SYN floods, or mistakenly think 'amplification' refers to the large number of SYN packets.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
TCP
TCP is a connection-oriented transport layer protocol that ensures reliable, ordered, and error-checked delivery of data between applications over IP networks.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.