CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst notices that a web server is experiencing slow response times, and the connection logs show many incomplete HTTP requests from various IP addresses, each keeping connections open for long periods. Which attack is MOST likely occurring?
⚠ Common exam trap
Many exam-takers confuse Slowloris with a SYN flood because both involve incomplete connections, but Slowloris operates at the application layer (HTTP) using partial headers, while SYN flood operates at the transport layer (TCP) using incomplete handshakes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Slowloris attack
The Slowloris attack works by opening multiple HTTP connections to the target web server and sending partial HTTP headers, then keeping those connections alive by sending periodic small packets to prevent timeout. This exhausts the server's connection pool, leading to slow response times and denial of service for legitimate users, matching the described symptoms of incomplete requests and long-held connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HTTP flood
Why it's wrong here
An HTTP flood attack involves overwhelming a web server by sending a massive volume of complete and legitimate-looking HTTP GET or POST requests. Unlike Slowloris, which keeps connections open with partial requests, an HTTP flood aims to exhaust the server's CPU, memory, and bandwidth by forcing it to process and respond to each full request. This high volume of processing ultimately prevents legitimate users from accessing the service due to resource starvation.
- ✓
Slowloris attack
Why this is correct
A Slowloris attack is a sophisticated application-layer denial-of-service (DoS) technique that targets web servers by holding open as many connections as possible for as long as possible. It achieves this by sending partial HTTP requests, such as incomplete headers, and then periodically sending small, non-essential data to keep the connection alive. This strategy exhausts the server's limited connection pool, preventing new, legitimate connections from being established and effectively denying service to other users.
- ✗
SYN flood
Why it's wrong here
A SYN flood is a classic transport-layer denial-of-service attack that exploits the TCP three-way handshake process. The attacker sends a large number of TCP SYN requests to the target server but never completes the handshake by sending the final ACK packet. This leaves the server with numerous "half-open" connections, consuming its connection table resources and preventing it from establishing new, legitimate TCP connections, thereby denying service.
- ✗
UDP flood
Why it's wrong here
A UDP flood is a network-layer denial-of-service attack that overwhelms a target server or network with a massive volume of User Datagram Protocol (UDP) packets. Since UDP is a connectionless protocol, the attacker can spoof the source IP address and send packets to random ports on the target. The server then expends resources generating ICMP "Destination Unreachable" replies, or simply struggles to process the sheer volume of incoming traffic, leading to bandwidth saturation and service disruption.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.