CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst observes a sudden increase in network traffic from many external IPs targeting the company's web server with multiple HTTP GET requests to the same page (/index.php?page=home). The requests appear legitimate but are coming at a very high rate. Which TWO types of attack is the analyst most likely witnessing?
⚠ Common exam trap
The trap here is that candidates might confuse a high-rate HTTP GET flood with a volumetric attack (Option B) or a SYN flood (Option D), but the key distinction is that this attack specifically targets the application layer by exhausting server resources through legitimate-looking HTTP requests, not by saturating bandwidth or exploiting TCP handshake mechanics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application-layer (Layer 7) attack
The attack targets the application layer (Layer 7) by sending numerous HTTP GET requests to a specific page (/index.php?page=home). This type of attack aims to exhaust server resources like CPU, memory, or database connections, as each request appears legitimate but collectively overwhelms the web server's ability to process them. It is a classic example of an HTTP flood, which is a Layer 7 attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Smurf attack
Why it's wrong here
A Smurf attack is an older form of Distributed Denial-of-Service (DDoS) that relies on ICMP echo requests sent to an IP broadcast address with a spoofed source IP of the victim. The numerous ICMP echo replies from all active hosts on the broadcast network then flood the victim, overwhelming their network interface. This attack mechanism is distinct from the scenario described, which involves HTTP GET requests, indicating an application-layer interaction rather than an ICMP-based network layer flood.
- ✗
Volumetric attack
Why it's wrong here
Volumetric attacks aim to consume all available bandwidth between the target and the internet, typically operating at the network or transport layers (Layers 3 and 4) of the OSI model. Examples include UDP floods or ICMP floods, which generate massive amounts of traffic to saturate the network pipe. The described scenario, involving HTTP GET requests targeting a specific web page, is focused on exhausting application resources rather than merely saturating bandwidth, making it an application-layer concern.
- ✓
Application-layer (Layer 7) attack
Why this is correct
An application-layer (Layer 7) attack specifically targets the application layer of the OSI model, exploiting vulnerabilities or resource limitations within the application itself. The observation of a sudden increase in HTTP GET requests directed at a specific web page perfectly aligns with this definition. These requests consume server resources like CPU, memory, and database connections, ultimately leading to service degradation or denial for legitimate users without necessarily saturating network bandwidth.
- ✗
SYN flood attack
Why it's wrong here
A SYN flood attack operates at the transport layer (Layer 4) by exploiting the TCP three-way handshake process. Attackers send a high volume of SYN packets to the target server but never complete the handshake with the final ACK packet, leaving the server with many half-open connections. This exhausts the server's connection table resources. The observed activity, however, involves complete HTTP GET requests, indicating established TCP connections and interaction at a higher layer than a SYN flood.
- ✓
Distributed denial-of-service (DDoS) attack
Why this is correct
A Distributed Denial-of-Service (DDoS) attack involves multiple compromised computer systems, often referred to as a botnet, launching a coordinated attack against a single target. The key characteristic is the distributed nature of the source traffic, making it significantly more difficult to block by simply filtering a single IP address. The observation of a sudden increase in HTTP GET requests originating from multiple external IP addresses directly indicates a coordinated, distributed effort to overwhelm the target service, consistent with a DDoS attack.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.