N10-009 Network Security Practice Question
A security analyst notices that a web server is receiving a large number of ICMP echo reply packets from many different external hosts. The server did not send any echo requests. Which type of attack is most likely occurring?
⚠ Common exam trap
The N10-009 exam often tests the distinction between a Smurf attack (unsolicited replies from many hosts due to a spoofed broadcast request) and a ping flood (direct requests from the attacker to the victim), so candidates mistakenly choose 'ping flood' when they see a flood of ICMP traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Smurf attack
A Smurf attack exploits IP broadcast addressing and ICMP. The attacker sends a large number of ICMP echo request packets with a spoofed source IP (the victim's IP) to a network's broadcast address. All hosts on that network then send ICMP echo reply packets to the victim, overwhelming it with traffic. Since the server never sent any echo requests, the unsolicited flood of echo replies is the hallmark of a Smurf attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Smurf attack
Why this is correct
A Smurf attack is a distributed denial-of-service (DDoS) attack that leverages an IP broadcast network to amplify traffic. The attacker sends ICMP echo requests (pings) to an IP broadcast address, spoofing the source IP to be that of the victim web server. All hosts on the broadcast network then reply to the spoofed source IP, flooding the victim with a massive volume of ICMP echo replies from numerous sources, overwhelming its network resources. This results in the web server receiving a flood of ICMP traffic from many different machines.
- ✗
Ping flood
Why it's wrong here
A ping flood is a basic denial-of-service (DoS) attack where an attacker directly sends an overwhelming number of ICMP echo request packets to a target server. The goal is to consume the target's bandwidth and processing resources by forcing it to respond to each request, thereby making it unavailable to legitimate users. Crucially, this attack involves the victim receiving requests directly from the attacker, not a flood of replies from numerous intermediary sources.
When this WOULD be correct
A ping flood would be correct if the question described a server receiving a high volume of ICMP echo request packets from a single or multiple sources, causing resource exhaustion, without any mention of unsolicited replies.
- ✗
ICMP tunneling
Why it's wrong here
ICMP tunneling is a technique used for covert communication, where data is encapsulated within the payload of ICMP echo request and reply packets. This method allows attackers to establish a hidden communication channel, often for data exfiltration or command and control, bypassing some firewall rules that permit ICMP traffic. Unlike a flood attack, ICMP tunneling focuses on discreet data transfer rather than overwhelming a target with a high volume of traffic.
- ✗
Fraggle attack
Why it's wrong here
A Fraggle attack is a denial-of-service (DoS) attack that operates on principles similar to a Smurf attack but utilizes UDP echo packets instead of ICMP. The attacker sends UDP packets to a broadcast address, spoofing the victim's IP address as the source. Devices on the broadcast network then send UDP echo replies to the victim, creating a flood of UDP traffic that can overwhelm the target server's network capacity and processing capabilities.
When this WOULD be correct
A Fraggle attack would be correct if the question described a large number of UDP echo or chargen packets from many external hosts targeting a victim, with the victim not sending any such requests.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Smurf attackCorrect answer▾
Why this is correct
A Smurf attack is a distributed denial-of-service (DDoS) attack that leverages an IP broadcast network to amplify traffic. The attacker sends ICMP echo requests (pings) to an IP broadcast address, spoofing the source IP to be that of the victim web server. All hosts on the broadcast network then reply to the spoofed source IP, flooding the victim with a massive volume of ICMP echo replies from numerous sources, overwhelming its network resources. This results in the web server receiving a flood of ICMP traffic from many different machines.
✗Ping floodWrong answer — click to see why▾
Why this is wrong here
A ping flood directly targets a victim by overwhelming it with ICMP echo request packets, not echo replies. The question states the server receives echo replies without sending requests, which is characteristic of a Smurf attack that amplifies replies from many hosts.
★ When this WOULD be the correct answer
A ping flood would be correct if the question described a server receiving a high volume of ICMP echo request packets from a single or multiple sources, causing resource exhaustion, without any mention of unsolicited replies.
Why candidates choose this
Candidates may confuse 'ping flood' with any ICMP-based denial-of-service attack, overlooking the specific distinction between echo requests (ping flood) and echo replies (Smurf attack).
✗Fraggle attackWrong answer — click to see why▾
Why this is wrong here
A Fraggle attack uses UDP echo (port 7) or chargen (port 19) traffic, not ICMP echo reply packets. The question specifies ICMP echo replies, which are characteristic of a Smurf attack.
★ When this WOULD be the correct answer
A Fraggle attack would be correct if the question described a large number of UDP echo or chargen packets from many external hosts targeting a victim, with the victim not sending any such requests.
Why candidates choose this
Candidates may confuse Fraggle with Smurf because both are amplification attacks that use spoofed source addresses and broadcast traffic; the key difference is the protocol (UDP vs ICMP).
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
ICMP
ICMP is a network-layer protocol used by network devices to send error messages and operational information about network connectivity.
Key term
ICMP
ICMP is a network protocol used by devices to send error messages and operational information about network communication problems.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.