N10-009 Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Man-in-the-middle attack

  Why it's wrong here

  A man-in-the-middle (MITM) attack involves an attacker secretly relaying and potentially altering the communication between two parties who believe they are directly communicating with each other. This attack focuses on intercepting, eavesdropping, or manipulating data in transit, often through techniques like ARP spoofing or DNS poisoning. Sending a flood of SYN packets, as described, is a direct denial-of-service technique, not an interception or relaying method characteristic of a MITM attack.

  When this WOULD be correct

  This would be correct in a scenario where an attacker intercepts and relays messages between two hosts who believe they are directly communicating, such as when an attacker uses ARP spoofing to intercept traffic on a local network.

• ✓

  SYN flood attack

  Why this is correct

  A SYN flood attack exploits the TCP three-way handshake by sending a large volume of SYN (synchronize) packets to a target server. The attacker, in this case, the compromised internal server, does not respond to the server's SYN-ACK (synchronize-acknowledge) replies, leaving numerous half-open connections in the server's connection state table. This rapid exhaustion of available connection resources prevents legitimate clients from establishing new connections, effectively causing a denial of service.

• ✗

  DDoS amplification attack

  Why it's wrong here

  A DDoS amplification attack involves an attacker sending small, specially crafted requests to legitimate, open third-party servers (like DNS or NTP servers) with the victim's spoofed IP address as the source. These servers then respond with significantly larger replies directed at the victim, amplifying the attack traffic volume. While a SYN flood is a denial-of-service attack, it directly sends SYN packets to the victim and does not rely on leveraging intermediate services to generate larger responses, thus it is not an amplification technique.

  When this WOULD be correct

  This option would be correct in a scenario where an attacker sends small requests (e.g., DNS or NTP queries) with a spoofed victim IP to a server, and the server responds with much larger replies to the victim, overwhelming it. For example, 'A server receives a small DNS query from a spoofed IP and sends a large DNS response to that IP, causing network congestion.'

• ✗

  Smurf attack

  Why it's wrong here

  A Smurf attack is a type of distributed denial-of-service (DDoS) attack that leverages ICMP (Internet Control Message Protocol) echo requests. The attacker sends ICMP echo requests to a network's broadcast address, spoofing the source IP address to be that of the intended victim. All hosts on the broadcast network then reply to the victim's spoofed IP with ICMP echo replies, overwhelming the victim with a flood of traffic. The scenario explicitly describes TCP SYN packets, not ICMP, making a Smurf attack an incorrect classification.

  When this WOULD be correct

  A Smurf attack would be correct if the question described an attacker sending ICMP echo requests to a network broadcast address with a spoofed source IP, resulting in a flood of ICMP replies overwhelming the victim.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question