CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst observes a sudden surge in incoming UDP traffic to the company's DNS servers from multiple external IP addresses. The packets appear to be DNS queries with spoofed source IPs. Which type of DDoS attack is MOST likely occurring?
⚠ Common exam trap
Many candidates confuse a simple UDP flood (direct traffic) with a DNS amplification attack, missing the key indicator of spoofed source IPs and the reflection/amplification mechanism that distinguishes it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS amplification
The attack described involves DNS queries with spoofed source IPs sent to a DNS server, which then responds with large replies to the victim (the spoofed IP). This is a classic DNS amplification attack, a type of reflection-based DDoS that exploits the large response-to-query ratio (e.g., an ANY query can yield a response up to 70x larger) to overwhelm the target. The surge in incoming UDP traffic to the DNS server is the attacker's queries, while the amplified responses are directed at the spoofed victim.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SYN flood
Why it's wrong here
A SYN flood is a denial-of-service attack that specifically targets the TCP protocol by exploiting its three-way handshake mechanism. Attackers send a high volume of SYN requests with spoofed source IP addresses, causing the target server to allocate resources for numerous half-open connections. Since the observed surge is in UDP traffic, an attack leveraging TCP-specific vulnerabilities like SYN floods would not be the cause.
- ✓
DNS amplification
Why this is correct
DNS amplification is a highly effective distributed denial-of-service (DDoS) attack where attackers send small UDP DNS queries with a spoofed source IP address (the victim's IP) to numerous open DNS resolvers. These resolvers then respond with much larger UDP packets containing DNS records, directed back to the spoofed victim. This technique leverages the amplification factor of DNS responses to overwhelm the target with a massive surge of incoming UDP traffic, typically on port 53.
- ✗
UDP flood
Why it's wrong here
A generic UDP flood involves an attacker directly sending a large volume of UDP packets to random or specific ports on a target server, aiming to consume bandwidth and system resources. Unlike amplification attacks, this method relies on the attacker's own bandwidth to generate the traffic, rather than leveraging third-party reflectors. While it causes a surge in UDP traffic, it lacks the amplification mechanism and specific application-layer interaction seen in DNS amplification.
- ✗
ICMP flood
Why it's wrong here
An ICMP flood, also known as a 'ping flood,' is a denial-of-service attack that overwhelms a target with a massive volume of ICMP (Internet Control Message Protocol) echo request packets. The victim's system is forced to process and respond to these requests, consuming bandwidth and CPU cycles. Since ICMP is a separate network layer protocol, distinct from UDP, an ICMP flood would not manifest as a surge in incoming UDP traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.