CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst observes a sudden flood of ICMP echo request packets from multiple external IPs to a single internal server. The packets have varying sizes and spoofed source addresses. Which type of attack is MOST likely occurring?
⚠ Common exam trap
Many exam-takers confuse a Smurf attack with a direct ICMP flood, because both use ICMP echo requests, but Smurf relies on network broadcast amplification while an ICMP flood is a direct, high-volume barrage from many sources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ICMP flood
An ICMP flood attack involves overwhelming a target with a high volume of ICMP echo request (ping) packets, often with spoofed source addresses and varying packet sizes, to consume bandwidth and processing resources. The description matches this exactly: multiple external IPs sending a flood of ICMP echo requests to a single server, which is the classic behavior of a distributed ICMP flood.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ping of Death
Why it's wrong here
The Ping of Death attack exploits vulnerabilities in older operating systems by sending an ICMP echo request packet that, when reassembled, exceeds the maximum allowed IP packet size (65,535 bytes). This oversized packet causes a buffer overflow in the target system's TCP/IP stack, leading to a system crash or reboot. It is a malformed packet attack, distinct from a volumetric flood of standard-sized packets.
- ✓
ICMP flood
Why this is correct
An ICMP flood, also known as a "ping flood," is a classic volumetric Denial-of-Service (DoS) attack where an attacker overwhelms a target system or network with a massive volume of ICMP echo request (ping) packets. The goal is to consume all available bandwidth or processing resources, preventing legitimate traffic from reaching the target. Often, these requests use spoofed source IP addresses to hide the attacker's identity and complicate mitigation efforts.
- ✗
Smurf attack
Why it's wrong here
A Smurf attack is a distributed Denial-of-Service (DoS) attack that leverages an intermediary network's directed broadcast address to amplify traffic. The attacker sends ICMP echo requests with the victim's spoofed IP address as the source to the broadcast address of a large network. All hosts on that network then reply to the victim, flooding them with a massive volume of ICMP echo replies, which is distinct from a direct flood from multiple sources.
- ✗
SYN flood
Why it's wrong here
A SYN flood is a Denial-of-Service (DoS) attack that exploits the TCP three-way handshake mechanism. The attacker sends a high volume of TCP SYN requests to the target server but never completes the handshake by sending the final ACK. This leaves numerous "half-open" connections, exhausting the server's connection table resources and preventing legitimate clients from establishing new connections, fundamentally different from an ICMP-based attack.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.