CEH Practice Question: Malware, Social Engineering and Network Attacks
A network administrator notices unusual traffic patterns: the internal DNS server is receiving large DNS queries with the source IP spoofed to appear as the internal DNS server itself. The queries appear to be amplification requests. Which TWO characteristics describe this attack?
⚠ Common exam trap
Candidates often confuse DNS amplification with other reflection attacks (e.g., NTP amplification) or mistakenly think the attacker must be on the same subnet, when in fact IP spoofing allows the attack to originate from anywhere.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It relies on open DNS resolvers to amplify traffic
The attack described relies on open DNS resolvers to amplify traffic. The attacker sends small DNS queries with a spoofed source IP (the victim's DNS server), causing the open resolver to send large responses to the victim, thus amplifying the traffic volume. This is a classic DNS amplification attack, which is a type of reflection attack that exploits the UDP protocol and the fact that DNS response sizes can be significantly larger than query sizes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It is a protocol-specific attack targeting TCP SYN packets
Why it's wrong here
This statement describes a SYN flood attack, which specifically targets the TCP three-way handshake by overwhelming a server with SYN requests and spoofed source IPs, leaving half-open connections. DNS amplification, however, leverages the UDP protocol for DNS queries, sending small requests that elicit much larger UDP responses. Therefore, it does not involve TCP SYN packets.
- ✓
It relies on open DNS resolvers to amplify traffic
Why this is correct
This is correct because DNS amplification attacks exploit misconfigured or intentionally open DNS resolvers that are accessible on the internet. Attackers send small DNS queries to these resolvers, spoofing the victim's IP address as the source. The open resolvers then respond with significantly larger DNS records to the unsuspecting victim, effectively multiplying the attacker's initial traffic volume.
- ✗
It exploits the ARP protocol to redirect traffic
Why it's wrong here
This option describes ARP poisoning, a Layer 2 attack where an attacker sends forged ARP messages over a local area network. This manipulates the victim's ARP cache to associate the attacker's MAC address with the IP address of a legitimate gateway or host, thereby redirecting traffic within the local subnet. DNS amplification attacks, conversely, operate at higher layers and do not involve the Address Resolution Protocol.
- ✓
It is a form of DDoS attack
Why this is correct
This is accurate because DNS amplification is a distributed denial-of-service (DDoS) attack technique. Attackers leverage numerous legitimate, but vulnerable, DNS servers to flood a target victim with an overwhelming volume of traffic, rendering their services unavailable. The "distributed" aspect comes from using multiple reflectors, and the "denial of service" from the resulting service disruption.
- ✗
It requires the attacker to be on the same subnet as the victim
Why it's wrong here
This statement is incorrect because DNS amplification attacks typically involve IP address spoofing, where the attacker sends DNS queries with the victim's IP address as the source. This allows the attacker to launch the attack from anywhere on the internet, without needing to be physically located on the same local subnet as the victim or the DNS resolvers. The attack relies on global internet connectivity, not local network presence.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.