CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst observes the following in a packet capture: a single source IP sends a large number of ICMP echo request packets to the broadcast address of a subnet, with the source IP spoofed to be the target victim. Which type of attack is being executed?
⚠ Common exam trap
It's easy for candidates to confuse a Smurf attack with a standard ICMP flood, but the key differentiator is the use of a broadcast address and IP spoofing to achieve amplification, which is unique to the Smurf attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Smurf attack
The Smurf attack exploits IP broadcast addressing and ICMP. The attacker sends a large volume of ICMP echo request packets with the source IP spoofed to be the victim's IP address, directed to the subnet's broadcast address. Every host on that subnet replies to the victim, overwhelming it with ICMP echo reply traffic, effectively amplifying the attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Smurf attack
Why this is correct
A Smurf attack is a classic denial-of-service technique that exploits ICMP echo requests and network broadcast addresses. The attacker sends ICMP echo requests to a network's broadcast address, spoofing the source IP to be the victim's address. All hosts on that broadcast network then reply to the victim's spoofed IP, creating a massive flood of ICMP echo replies that overwhelms the victim's network bandwidth and resources.
- ✗
SYN flood
Why it's wrong here
A SYN flood is a denial-of-service attack that targets the TCP three-way handshake, not ICMP. The attacker sends a high volume of TCP SYN packets to a target server with spoofed source IP addresses. This prevents the server from completing the handshake, leaving numerous half-open connections that exhaust the server's connection table and memory resources, rendering it unable to accept legitimate connections.
- ✗
Ping of Death
Why it's wrong here
The Ping of Death was a historical denial-of-service attack that involved sending an ICMP echo request packet larger than the maximum allowed IP packet size of 65,535 bytes. Although fragmented for transmission, the reassembled oversized packet would cause buffer overflows or system crashes in vulnerable operating systems. Modern operating systems are largely immune to this specific vulnerability due to improved IP stack handling and memory management.
- ✗
ICMP flood
Why it's wrong here
An ICMP flood, often called a 'ping flood,' is a straightforward denial-of-service attack where an attacker directly sends a massive volume of ICMP echo request packets to a target. Unlike a Smurf attack, it does not rely on broadcast amplification or an intermediary network to magnify the traffic. The primary goal is to consume the victim's incoming bandwidth and processing resources with direct, high-volume ICMP traffic, rather than leveraging reflection.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.