N10-009 Network Security Practice Question
A security analyst notices that an attacker is sending crafted packets with overlapping IP fragments to a target server, causing the server to crash. Which type of attack is described?
⚠ Common exam trap
CompTIA often tests the distinction between attacks that exploit protocol logic flaws (like Teardrop) versus volumetric or handshake-based attacks, so candidates may confuse Teardrop with a SYN flood because both can cause crashes, but the key difference is that Teardrop targets IP fragmentation, not TCP state exhaustion.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Teardrop attack
This is a Teardrop attack, which exploits a vulnerability in the IP fragmentation reassembly process. The attacker sends a series of fragmented IP packets with intentionally overlapping fragment offsets, causing the target system to miscalculate the size of the reassembled packet, leading to a buffer overflow and system crash. This attack specifically targets the IP stack's handling of fragment offset fields in the IP header.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Teardrop attack
Why this is correct
The Teardrop attack is a denial-of-service (DoS) attack that exploits vulnerabilities in the reassembly of fragmented IP packets. Attackers send crafted IP fragments with overlapping or oversized offset fields, causing the target system to crash or reboot when it attempts to reconstruct the malformed datagram. This manipulation of IP fragmentation logic prevents proper packet processing and disrupts network services, directly matching the description of an attacker sending crafted packets.
- ✗
Smurf attack
Why it's wrong here
The Smurf attack is a distributed denial-of-service (DDoS) technique that leverages ICMP Echo Request packets with a spoofed source IP address, targeting a victim. These requests are sent to an IP broadcast address within a large network, causing all hosts on that network to reply to the spoofed source IP, thereby flooding the actual target with amplified ICMP Echo Reply traffic. This amplification effect can quickly overwhelm the victim's network capacity, but it does not involve overlapping IP fragments.
When this WOULD be correct
A Smurf attack would be correct if the question described an attacker sending ICMP echo requests to a network broadcast address with a spoofed source IP, causing all hosts to reply to the victim and overwhelming it with traffic.
- ✗
Ping flood
Why it's wrong here
A Ping flood is a straightforward denial-of-service (DoS) attack where the attacker overwhelms a target with a massive volume of Internet Control Message Protocol (ICMP) Echo Request packets. This high-bandwidth attack aims to saturate the victim's network connection or exhaust its processing resources by forcing it to respond to an excessive number of ICMP requests. Unlike fragmentation-based attacks, it relies purely on volumetric traffic and does not involve manipulating IP fragment offsets.
When this WOULD be correct
A ping flood would be correct if the question described an attacker sending a high volume of ICMP Echo Request packets to consume bandwidth or CPU resources, potentially causing denial of service.
- ✗
SYN flood
Why it's wrong here
A SYN flood is a denial-of-service (DoS) attack that exploits the TCP three-way handshake mechanism. The attacker sends a large number of TCP SYN requests to a target server but never completes the handshake by sending the final ACK packet. This leaves numerous half-open connections in the server's memory, exhausting its connection table and preventing legitimate clients from establishing new connections. This attack targets TCP connection states, not IP fragmentation.
When this WOULD be correct
A SYN flood would be correct if the question described an attacker sending a high volume of TCP SYN packets to a server, overwhelming its connection queue and causing denial of service.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Teardrop attackCorrect answer▾
Why this is correct
The Teardrop attack is a denial-of-service (DoS) attack that exploits vulnerabilities in the reassembly of fragmented IP packets. Attackers send crafted IP fragments with overlapping or oversized offset fields, causing the target system to crash or reboot when it attempts to reconstruct the malformed datagram. This manipulation of IP fragmentation logic prevents proper packet processing and disrupts network services, directly matching the description of an attacker sending crafted packets.
✗Smurf attackWrong answer — click to see why▾
Why this is wrong here
The Smurf attack involves sending ICMP echo requests with a spoofed source IP to a network's broadcast address, causing amplification and flooding the victim, not using overlapping IP fragments to crash a server.
★ When this WOULD be the correct answer
A Smurf attack would be correct if the question described an attacker sending ICMP echo requests to a network broadcast address with a spoofed source IP, causing all hosts to reply to the victim and overwhelming it with traffic.
Why candidates choose this
Candidates may confuse any attack that causes a denial of service with the Smurf attack, especially if they recall it involves IP-based flooding, but they miss the specific mechanism of overlapping fragments unique to teardrop.
✗Ping floodWrong answer — click to see why▾
Why this is wrong here
A ping flood involves overwhelming a target with ICMP Echo Request packets, not crafted packets with overlapping IP fragments that cause a crash due to reassembly errors.
★ When this WOULD be the correct answer
A ping flood would be correct if the question described an attacker sending a high volume of ICMP Echo Request packets to consume bandwidth or CPU resources, potentially causing denial of service.
Why candidates choose this
Candidates may confuse any network-based DoS attack with a ping flood, as ping is a common tool and the term 'flood' is broadly associated with overwhelming traffic.
✗SYN floodWrong answer — click to see why▾
Why this is wrong here
A SYN flood attack involves sending many TCP SYN requests to exhaust server resources, not sending crafted packets with overlapping IP fragments.
★ When this WOULD be the correct answer
A SYN flood would be correct if the question described an attacker sending a high volume of TCP SYN packets to a server, overwhelming its connection queue and causing denial of service.
Why candidates choose this
Candidates may confuse SYN flood with any attack that causes a server to crash, overlooking the specific mention of overlapping IP fragments which is characteristic of a teardrop attack.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Wireless Security Protocols
Key term
Packet
A packet is a small unit of data that is sent over a network, containing both the actual data and control information for delivery.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.