SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A public-facing web service suddenly becomes very slow. NetFlow shows a high volume of small DNS queries leaving attacker-controlled systems and much larger DNS responses arriving at the victim's IP address from many different resolvers. Which attack is taking place?
⚠ Common exam trap
Many exam-takers confuse the high volume of DNS traffic with a normal DNS flood or a reflection attack, but the key differentiator is the amplification ratio—small queries generating large responses—which is unique to amplification DDoS, not a simple reflection or volumetric flood.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS amplification DDoS
This is a DNS amplification DDoS attack. The attacker sends small DNS queries with a spoofed source IP (the victim's IP) to open DNS resolvers, which then send large DNS responses to the victim. The high volume of small queries and much larger responses from many resolvers is the classic signature of an amplification attack, exploiting the UDP protocol's lack of source verification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DNS amplification DDoS
Why this is correct
DNS amplification is a reflection-based volumetric DDoS attack: the attacker sends small UDP queries (often using the ANY or DNSSEC record types) to numerous open recursive resolvers, spoofing the victim's IP address as the source. The resolvers then send large responses (up to 50-100 times the request size) to the victim, saturating its bandwidth and connection table. Netflow would show a flood of inbound UDP traffic from many DNS servers to the victim, with little or no corresponding outbound traffic, which matches the observed slowdown.
- ✗
Replay attack
Why it's wrong here
A replay attack involves capturing legitimate network traffic and retransmitting it later to trick a receiver, such as replaying an authentication packet or a signed transaction. This does not generate a distributed flood of amplified responses, and the netflow would show repeated identical packets rather than a high-volume reflection pattern. Replay attacks target protocol logic or authentication, not network bandwidth, and would not cause a sudden web service slowdown via massive DNS responses.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning operates at Layer 2 (data link layer) by sending forged ARP replies to associate the attacker's MAC address with the IP of a legitimate host, enabling local man-in-the-middle interception. It is confined to a single broadcast domain and does not scale to a distributed, public-facing DDoS; moreover, netflow typically samples Layer 3/4 flows and often does not even capture ARP traffic. This attack would affect local host communication, not generate the large-scale inbound UDP flood observed in the scenario.
- ✗
Session fixation
Why it's wrong here
Session fixation is a web application attack where the attacker forces a victim to use a known session ID and later hijacks the session after the victim authenticates. It involves manipulating cookies or URL parameters and requires active user interaction, not automated bandwidth exhaustion. This attack does not produce any distinctive high-volume network flow pattern, and netflow would show normal HTTP traffic rather than a DNS amplification flood.
Visual reference
Go deeper
Related to this question
Learn chapter
DoS and DDoS Attacks
Key term
DNS
DNS is the system that translates human-friendly domain names like example.com into machine-readable IP addresses so computers can find each other on a network.
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A web service begins experiencing severe latency. Netflow shows thousands of short DNS queries leaving the attacker network, while a much larger volume of DNS responses is arriving at the victim’s public IP address from many open resolvers. Which attack is most likely occurring?
medium- A.Replay attack using previously captured packets
- ✓ B.DNS reflection and amplification denial-of-service attack
- C.ARP poisoning that redirects local traffic on a LAN
- D.Session hijacking through stolen authentication cookies
Why B: The attack described is a DNS reflection and amplification denial-of-service attack. The attacker sends thousands of short DNS queries with a spoofed source IP (the victim's IP) to many open resolvers, which then send large DNS responses to the victim, overwhelming its bandwidth. NetFlow shows a small volume of queries leaving the attacker and a much larger volume of responses arriving at the victim, which is the hallmark of amplification (small request, large response) combined with reflection (responses from third-party resolvers).
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.