CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst notices repeated TCP SYN packets sent to a server without corresponding SYN-ACK replies. The source IP addresses are spoofed and appear to be random. Which type of attack is MOST likely occurring?
⚠ Common exam trap
Candidates often confuse a SYN flood with a UDP flood because both are volumetric attacks, but the key differentiator is the use of TCP SYN packets and the spoofed source IPs targeting the handshake process, not just any protocol flood.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SYN flood
A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IP addresses to a target server. The server responds with SYN-ACK packets to the spoofed addresses, which never complete the handshake, causing the server to exhaust its memory and CPU resources by maintaining half-open connections. This matches the described behavior of repeated SYN packets without corresponding SYN-ACK replies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SYN flood
Why this is correct
A SYN flood is a classic Denial-of-Service (DoS) attack that exploits the TCP three-way handshake. Attackers send a large volume of TCP SYN requests to a target server, often with spoofed source IP addresses. The server responds with SYN-ACK packets and allocates resources to maintain a half-open connection, waiting for the final ACK that never arrives, eventually exhausting its connection table and preventing legitimate connections.
- ✗
UDP flood
Why it's wrong here
A UDP flood is a Denial-of-Service (DoS) attack that overwhelms a target system or network with a large volume of User Datagram Protocol (UDP) packets. Unlike TCP SYN floods, UDP is a connectionless protocol, meaning no handshake is required, and the attack focuses on consuming bandwidth or exhausting server resources by sending requests to specific services like DNS or NTP. The server expends resources processing these unsolicited packets, potentially leading to service degradation or unavailability.
- ✗
ICMP flood
Why it's wrong here
An ICMP flood targets network availability by overwhelming a host with echo request packets, but the scenario describes TCP SYN packets with spoofed IPs and no SYN-ACK replies—this is a half-open connection exhaustion technique that ICMP cannot replicate. It is tempting because ICMP floods are a common denial-of-service vector, and if the question described a flood of ping requests consuming bandwidth or CPU, ICMP flood would be the correct choice.
- ✗
Ping of Death
Why it's wrong here
The Ping of Death is an older Denial-of-Service (DoS) attack that involved sending an oversized Internet Control Message Protocol (ICMP) echo request packet to a target system. This oversized packet, exceeding the maximum IP packet size of 65,535 bytes, would be fragmented during transmission. When the vulnerable target attempted to reassemble these fragments, it would often crash or reboot due to buffer overflow issues, a mechanism distinct from exhausting TCP connection states.
Visual reference
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.