N10-009 Network Security Practice Question
A security analyst notices that the company's web server is receiving a high volume of TCP SYN packets from a single source IP address, but the server is not completing the three-way handshake. Which type of attack is most likely occurring?
⚠ Common exam trap
CompTIA often tests the distinction between a SYN flood and a Smurf attack by describing a flood of packets from a single source—candidates confuse the ICMP-based Smurf attack with the TCP-based SYN flood because both involve flooding, but the protocol and mechanism are completely different.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A) SYN flood
A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets from a spoofed or single source IP without completing the handshake. The server allocates resources for each half-open connection, eventually exhausting its connection table and denying service to legitimate users. This matches the scenario where the server receives many SYN packets but never completes the handshake.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A) SYN flood
Why this is correct
A SYN flood is a classic Denial-of-Service (DoS) attack that exploits the TCP three-way handshake. The attacker sends a large volume of TCP SYN requests with spoofed source IP addresses to a target server. The server responds with SYN-ACK packets and allocates resources for each half-open connection, awaiting a final ACK that never arrives. This eventually exhausts the server's connection table and prevents legitimate connections from being established.
- ✗
B) Smurf attack
Why it's wrong here
A Smurf attack is a distributed Denial-of-Service (DoS) attack leveraging ICMP echo requests and IP broadcast addresses. An attacker sends ICMP echo requests with the victim's spoofed IP address as the source to an IP broadcast address on a network. All hosts on that network then reply to the victim, flooding it with ICMP echo replies and overwhelming its network capacity. This attack does not involve TCP SYN packets.
When this WOULD be correct
A Smurf attack would be correct if the question described a high volume of ICMP echo reply packets (or ping replies) overwhelming a target, or if the attack involved sending ICMP echo requests to a network broadcast address with a spoofed source IP.
- ✗
C) Ping of death
Why it's wrong here
The Ping of death is an older Denial-of-Service (DoS) attack that exploits vulnerabilities in IP fragmentation and reassembly. An attacker sends an ICMP echo request packet that is larger than the maximum allowed IP packet size (65,535 bytes) after fragmentation. When the target system attempts to reassemble this oversized, malformed packet, it can lead to a buffer overflow, system crash, or reboot, rendering the service unavailable. This attack relies on ICMP, not TCP SYN packets.
When this WOULD be correct
This option would be correct in a question describing a server crashing or becoming unresponsive after receiving a single oversized ICMP echo request packet, or a series of fragmented ICMP packets that reassemble into a packet larger than 65535 bytes.
- ✗
D) ARP poisoning
Why it's wrong here
ARP poisoning, also known as ARP spoofing, is a Layer 2 attack where an attacker sends forged Address Resolution Protocol (ARP) messages onto a local area network. The goal is to associate the attacker's MAC address with the IP address of another host, such as the default gateway or another victim. This allows the attacker to intercept, modify, or drop traffic intended for the legitimate host, effectively performing a Man-in-the-Middle attack. It does not involve sending TCP SYN packets to a server.
When this WOULD be correct
An exam question describing an attacker sending forged ARP replies to associate their MAC address with the default gateway's IP, causing traffic to be redirected to the attacker, would make ARP poisoning the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓A) SYN floodCorrect answer▾
Why this is correct
A SYN flood is a classic Denial-of-Service (DoS) attack that exploits the TCP three-way handshake. The attacker sends a large volume of TCP SYN requests with spoofed source IP addresses to a target server. The server responds with SYN-ACK packets and allocates resources for each half-open connection, awaiting a final ACK that never arrives. This eventually exhausts the server's connection table and prevents legitimate connections from being established.
✗B) Smurf attackWrong answer — click to see why▾
Why this is wrong here
A Smurf attack uses ICMP echo requests (pings) to a broadcast address, causing all hosts on the network to reply to a spoofed victim IP, overwhelming it with ICMP replies, not TCP SYN packets.
★ When this WOULD be the correct answer
A Smurf attack would be correct if the question described a high volume of ICMP echo reply packets (or ping replies) overwhelming a target, or if the attack involved sending ICMP echo requests to a network broadcast address with a spoofed source IP.
Why candidates choose this
Candidates may confuse any high-volume network attack with a Smurf attack, or they might think 'SYN flood' is too obvious and second-guess themselves, choosing a less familiar term.
✗C) Ping of deathWrong answer — click to see why▾
Why this is wrong here
A ping of death attack involves sending oversized or malformed ICMP packets to crash a system, not a high volume of TCP SYN packets that fail to complete the three-way handshake.
★ When this WOULD be the correct answer
This option would be correct in a question describing a server crashing or becoming unresponsive after receiving a single oversized ICMP echo request packet, or a series of fragmented ICMP packets that reassemble into a packet larger than 65535 bytes.
Why candidates choose this
Candidates may confuse any attack that overwhelms a server with 'ping of death' because both involve network flooding, but they fail to distinguish between ICMP-based attacks and TCP SYN floods.
✗D) ARP poisoningWrong answer — click to see why▾
Why this is wrong here
ARP poisoning manipulates the ARP cache to intercept traffic on a local network, not to flood a web server with TCP SYN packets from a single source.
★ When this WOULD be the correct answer
An exam question describing an attacker sending forged ARP replies to associate their MAC address with the default gateway's IP, causing traffic to be redirected to the attacker, would make ARP poisoning the correct answer.
Why candidates choose this
Candidates may confuse network-layer attacks (ARP poisoning) with transport-layer attacks (SYN flood) due to a lack of understanding of the TCP/IP model layers.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Wireless Security Protocols
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.