SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A web service begins experiencing severe latency. Netflow shows thousands of short DNS queries leaving the attacker network, while a much larger volume of DNS responses is arriving at the victim’s public IP address from many open resolvers. Which attack is most likely occurring?
⚠ Common exam trap
Candidates often confuse the high volume of responses arriving at the victim with a simple volumetric attack, missing the key indicators of reflection (responses from many different IPs) and amplification (small queries generating large responses), which uniquely identify a DNS reflection/amplification DDoS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS reflection and amplification denial-of-service attack
The attack described is a DNS reflection and amplification denial-of-service attack. The attacker sends thousands of short DNS queries with a spoofed source IP (the victim's IP) to many open resolvers, which then send large DNS responses to the victim, overwhelming its bandwidth. NetFlow shows a small volume of queries leaving the attacker and a much larger volume of responses arriving at the victim, which is the hallmark of amplification (small request, large response) combined with reflection (responses from third-party resolvers).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Replay attack using previously captured packets
Why it's wrong here
Replay attacks involve capturing and re-sending legitimate packets, such as an old authentication sequence or transaction request, to trick a system into repeating an authorized action or accepting a stale session. In this scenario, the netflow shows a distinct signature of small outbound DNS queries to many open resolvers followed by a large burst of inbound DNS responses, which is the hallmark of reflection/amplification, not a replay. A replay would replay the same packets verbatim and would not cause geographically distributed third-party resolvers to generate responses directed at the victim, so it fails to match the observed latency and traffic profile.
- ✓
DNS reflection and amplification denial-of-service attack
Why this is correct
This is the best match. The attacker sends small DNS requests that cause open resolvers to send much larger responses to the victim's IP address. Because the victim receives the responses, the attack uses reflection; because the responses are much larger than the requests, it also uses amplification. The result is bandwidth exhaustion and severe latency, which are common symptoms of a volumetric DDoS attack.
- ✗
ARP poisoning that redirects local traffic on a LAN
Why it's wrong here
ARP poisoning is a Layer 2 attack that spoofs ARP replies within a single local broadcast domain, tricking hosts into sending traffic to the attacker's MAC address for on-path interception or man-in-the-middle manipulation. It cannot scale to generate massive inbound traffic from external DNS resolvers because ARP is non-routable and confined to the local network. The reported network traffic shows high-volume UDP responses arriving at the victim's public IP from many open resolvers, which is inconsistent with local Layer 2 redirection and would not cause internet-wide latency.
- ✗
Session hijacking through stolen authentication cookies
Why it's wrong here
Session hijacking through stolen cookies or authentication tokens compromises an individual user's authenticated session, enabling unauthorized actions under that user's identity, typically via XSS, network sniffing, or session fixation. It does not produce a volumetric traffic pattern or a sudden flood of DNS responses; its impact is limited to the compromised session's privileges. The observed netflow of small outbound DNS requests followed by a disproportionately large inbound amplification response is a network-layer denial-of-service artifact, not a session-layer credential compromise.
Visual reference
Go deeper
Related to this question
Learn chapter
Network-Based Attacks
Key term
Denial-of-service
A Denial-of-service (DoS) attack is an attempt to make a computer, network, or online service unavailable to its intended users by overwhelming it with fake traffic or requests.
Key term
Public IP address
A globally unique IP address assigned to a device that allows it to communicate directly over the internet.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.