N10-009 Network Security Practice Question
A security engineer notices that the company's web server is receiving an overwhelming number of HTTP GET requests from thousands of different IP addresses around the world. The requests are for legitimate pages and are well-formed. The server is becoming unresponsive. Which type of attack is most likely occurring?
⚠ Common exam trap
It's easy for candidates to confuse a SYN flood (a TCP-level attack) with a DDoS attack that uses complete HTTP requests, but the question explicitly states the requests are 'well-formed' and for 'legitimate pages,' ruling out incomplete handshake attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DDoS attack
The attack involves a high volume of legitimate HTTP GET requests from many distinct IP addresses, overwhelming the web server. This is a classic distributed denial-of-service (DDoS) attack, where multiple compromised systems (a botnet) coordinate to flood the target with traffic, exhausting server resources and causing unresponsiveness. The key indicators are the distributed source IPs and the use of application-layer (HTTP) requests, which distinguishes it from network-layer floods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ARP spoofing
Why it's wrong here
ARP spoofing is a Layer 2 attack where an attacker sends forged Address Resolution Protocol (ARP) messages onto a local area network. Its primary goal is to associate the attacker's MAC address with the IP address of another host, such as a default gateway, to intercept or redirect network traffic. This technique is used for man-in-the-middle attacks or session hijacking, not for generating an overwhelming volume of direct requests to a web server to cause resource exhaustion.
When this WOULD be correct
A question describing a scenario where an attacker on the same subnet intercepts traffic between a client and server by sending forged ARP messages, causing the server to receive unexpected traffic or become unresponsive.
- ✗
SYN flood
Why it's wrong here
A SYN flood is a classic Denial-of-Service attack that exploits the TCP three-way handshake process. The attacker sends a high volume of SYN (synchronize) packets to the target server but never completes the handshake by sending the final ACK (acknowledgment) packet. This leaves numerous half-open connections in the server's memory, exhausting its connection table resources and preventing legitimate clients from establishing new connections, rather than overwhelming it with completed HTTP requests.
When this WOULD be correct
A SYN flood would be correct if the question described a server overwhelmed by a high volume of incomplete TCP connection requests (SYN packets) from spoofed IPs, causing the connection table to fill and legitimate connections to be refused.
- ✓
DDoS attack
Why this is correct
A Distributed Denial-of-Service (DDoS) attack is precisely characterized by an overwhelming volume of traffic, often comprising legitimate-looking requests, originating from numerous compromised or controlled sources. These requests are designed to consume the target web server's resources, such as CPU, memory, network bandwidth, or connection capacity, rendering it unavailable to legitimate users. The distributed nature makes it challenging to block by simply filtering a single source IP address, as the attack traffic appears to come from many different, seemingly valid clients.
- ✗
DNS amplification
Why it's wrong here
DNS amplification is a reflection-based DDoS attack that leverages open DNS resolvers to magnify a small query into a much larger response directed at a victim's spoofed IP address. The attacker sends small UDP queries to numerous DNS servers, with the source IP address forged to be the victim's. The large DNS responses are then sent to the victim, overwhelming their network bandwidth, rather than directly sending an overwhelming number of HTTP requests to a web server.
When this WOULD be correct
A question describing a server receiving a high volume of large DNS response packets from many different IPs, where the attacker spoofs the victim's IP as the source of small DNS queries to open resolvers, would make DNS amplification the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓DDoS attackCorrect answer▾
Why this is correct
A Distributed Denial-of-Service (DDoS) attack is precisely characterized by an overwhelming volume of traffic, often comprising legitimate-looking requests, originating from numerous compromised or controlled sources. These requests are designed to consume the target web server's resources, such as CPU, memory, network bandwidth, or connection capacity, rendering it unavailable to legitimate users. The distributed nature makes it challenging to block by simply filtering a single source IP address, as the attack traffic appears to come from many different, seemingly valid clients.
✗ARP spoofingWrong answer — click to see why▾
Why this is wrong here
ARP spoofing operates at Layer 2 and targets local network communications, not a web server receiving HTTP requests from thousands of global IP addresses.
★ When this WOULD be the correct answer
A question describing a scenario where an attacker on the same subnet intercepts traffic between a client and server by sending forged ARP messages, causing the server to receive unexpected traffic or become unresponsive.
Why candidates choose this
Candidates may confuse any network-based attack with ARP spoofing, or mistakenly think that overwhelming a server can be achieved via ARP manipulation.
✗SYN floodWrong answer — click to see why▾
Why this is wrong here
A SYN flood targets the TCP handshake by sending many SYN packets without completing the handshake, but this question specifies HTTP GET requests, which are application-layer and fully formed, not incomplete TCP connections.
★ When this WOULD be the correct answer
A SYN flood would be correct if the question described a server overwhelmed by a high volume of incomplete TCP connection requests (SYN packets) from spoofed IPs, causing the connection table to fill and legitimate connections to be refused.
Why candidates choose this
Candidates often confuse any network-based denial-of-service attack with a SYN flood because SYN floods are a common DoS technique, but they overlook that the attack here uses complete HTTP requests, not half-open TCP connections.
✗DNS amplificationWrong answer — click to see why▾
Why this is wrong here
DNS amplification attacks use reflection off open DNS resolvers to flood a target with amplified responses, not direct HTTP GET requests from many IPs. The question describes well-formed HTTP requests from diverse IPs, which is a classic DDoS, not a DNS-based attack.
★ When this WOULD be the correct answer
A question describing a server receiving a high volume of large DNS response packets from many different IPs, where the attacker spoofs the victim's IP as the source of small DNS queries to open resolvers, would make DNS amplification the correct answer.
Why candidates choose this
Candidates may confuse any large-scale distributed attack with DNS amplification because both involve many sources, but they overlook that DNS amplification relies on UDP reflection and amplified responses, not direct HTTP requests.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
IPv4 Address Class Summary
| Class | First Octet Range | Default Mask | Networks | Hosts per Network |
|---|---|---|---|---|
| A | 1–126 | /8 (255.0.0.0) | 126 | 16,777,214 |
| B | 128–191 | /16 (255.255.0.0) | 16,384 | 65,534 |
| C | 192–223 | /24 (255.255.255.0) | 2,097,152 | 254 |
| D | 224–239 | N/A | Multicast groups | — |
| E | 240–255 | N/A | Reserved / experimental | — |
127.x.x.x is reserved for loopback. Modern networks use CIDR (classless) rather than classful addressing.
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
DDoS
A DDoS (Distributed Denial-of-Service) attack is a malicious attempt to disrupt normal traffic of a targeted server, service, or network by overwhelming it with a flood of internet traffic from multiple compromised systems.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.