A public website is overwhelmed by a flood of DNS responses arriving from many open resolvers after the attacker sends small forged queries to those resolvers. The target bandwidth is saturated and the source IPs vary widely. What kind of attack is being used?

SYN flood

A SYN flood targets TCP handshake state, but this scenario is centered on DNS responses from third-party resolvers.

Replay attack

Replay attacks resend captured legitimate messages, but they do not create a large reflected response stream from resolvers.

Man-in-the-middle attack

A man-in-the-middle intercepts or alters traffic between parties, but the described symptom is bandwidth exhaustion from reflected traffic.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: DNS amplification DDoS — This is DNS amplification, a type of distributed denial-of-service attack that uses reflectors to turn a small amount of attacker traffic into a much larger volume of responses. Because the attacker forges the source address, the resolvers send the amplified DNS replies to the target. The result is bandwidth saturation, and the many resolver IPs in the logs are a strong indicator that reflection is involved rather than direct flooding. Why others are wrong: A SYN flood focuses on exhausting server resources during TCP connection setup, not on receiving large DNS responses from many resolvers. A replay attack reuses captured traffic and does not explain the large response amplification or the varied resolver source addresses. A man-in-the-middle attack is about interception or manipulation between two endpoints, not overwhelming a site with reflected DNS traffic.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.