CEH Practice Question: Malware, Social Engineering and Network Attacks
A network administrator notices an unusually high number of half-open TCP connections to the company's web server. The source IPs are spoofed. Which type of attack is MOST likely occurring?
⚠ Common exam trap
Watch out — candidates often confuse a SYN flood with a Smurf attack because both use spoofed IPs, but Smurf attacks rely on ICMP broadcast amplification, not TCP half-open connections.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SYN flood
A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IPs to the target server. The server responds with SYN-ACK packets and allocates resources for each half-open connection, exhausting its connection queue and preventing legitimate connections. The description of half-open TCP connections with spoofed source IPs is the classic signature of a SYN flood.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Smurf attack
Why it's wrong here
A Smurf attack is a distributed denial-of-service (DDoS) attack that leverages ICMP echo requests (pings) sent to a network's broadcast address. Attackers spoof the victim's IP address as the source for these requests, causing all hosts on the broadcast network to reply to the victim. While it floods the victim with ICMP echo replies, it does not involve TCP SYN packets or create half-open TCP connections, making it irrelevant to the scenario described.
- ✗
UDP flood
Why it's wrong here
A UDP flood saturates bandwidth with stateless packets, but the scenario specifies half-open TCP connections, which require the TCP three-way handshake state table to be exhausted. A UDP flood would not generate SYN packets or fill the connection backlog. It is tempting because both attacks aim to deny service, and a UDP flood is a common volumetric denial-of-service method, but it lacks the TCP-specific mechanism needed here.
- ✓
SYN flood
Why this is correct
A SYN flood is a classic denial-of-service attack that exploits the TCP three-way handshake. The attacker sends a large volume of TCP SYN (synchronize) requests to a target server but never completes the handshake by sending the final ACK (acknowledgment). This leaves numerous "half-open" connections in the server's memory, exhausting its connection table and preventing legitimate clients from establishing new connections, thus denying service.
- ✗
ICMP flood
Why it's wrong here
An ICMP flood, often referred to as a "ping flood," overwhelms a target system or network with a massive volume of ICMP echo request (ping) packets. The primary goal is to consume bandwidth and CPU resources, making the target unresponsive. Although it's a denial-of-service attack, it operates at the network layer (Layer 3) using ICMP, and does not involve TCP SYN packets or the establishment of half-open TCP connections, which are specific to the transport layer (Layer 4) and the TCP protocol.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.