SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A public web server becomes unreachable during an outage. Netflow shows a large number of DNS responses arriving from many open resolvers, while the server itself only sent tiny spoofed DNS queries with the victim's address as the source. What type of attack is this?
⚠ Common exam trap
Many candidates confuse the direction of traffic: candidates may think the server is the attacker because it sends queries, but the spoofed source IP and large incoming responses reveal it is the victim of a reflection attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS amplification reflection denial-of-service.
This is a classic DNS amplification reflection DDoS attack. The attacker sends small DNS queries with a spoofed source IP (the victim's address) to open resolvers, which then send large DNS responses to the victim, overwhelming its bandwidth. The NetFlow data shows the server receiving many large DNS responses while only sending tiny spoofed queries, confirming the amplification and reflection vectors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS zone transfer abuse against the organization.
Why it's wrong here
A DNS zone transfer (AXFR/IXFR) is a legitimate replication mechanism used to copy DNS records between authoritative name servers. An attacker exploiting a misconfigured server could enumerate internal hostnames or obtain a full map of the organization's DNS infrastructure, but this does not generate floods of unsolicited traffic to a victim. The netflow in the scenario shows a volumetric attack sourced from many external resolvers, not an information-disclosure query pattern.
- ✓
DNS amplification reflection denial-of-service.
Why this is correct
This is DNS amplification reflection because the attacker spoofs the victim's IP address in small requests to open resolvers, causing large responses to be sent to the victim instead. The result is a bandwidth flood that can make the server unreachable even though the victim never initiated the traffic. The key clues are tiny queries, spoofed source addresses, many resolvers, and a high volume of unsolicited responses. This is a classic distributed denial-of-service pattern.
- ✗
A replay attack against a web application session token.
Why it's wrong here
A replay attack occurs when an attacker captures a valid session token, cookie, or authentication handshake and blindly retransmits it to impersonate the legitimate user. This targets the application layer and could lead to unauthorized access, privilege escalation, or account takeover, but it produces no large-scale inbound network traffic. The outage was caused by a bandwidth flood of high-volume DNS responses from multiple resolvers, which is inconsistent with a simple replay of a token.
- ✗
ARP poisoning inside the local network segment.
Why it's wrong here
ARP poisoning (or ARP spoofing) involves sending forged Address Resolution Protocol messages over a local Ethernet segment to associate the attacker's MAC address with the victim's IP, enabling man-in-the-middle interception or selective packet dropping. This attack is strictly confined to the local subnet and operates at Layer 2, so it cannot generate the external UDP floods observed in the netflow. The response traffic in the scenario originates from distributed DNS resolvers on the internet, far beyond the local broadcast domain.
Visual reference
Go deeper
Related to this question
Learn chapter
DoS and DDoS Attacks
Key term
Distributed Denial-of-service
A cyberattack where many compromised computers flood a target system with traffic, making it unavailable to legitimate users.
Key term
Denial-of-service
A Denial-of-service (DoS) attack is an attempt to make a computer, network, or online service unavailable to its intended users by overwhelming it with fake traffic or requests.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.