CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst receives an alert about a workstation repeatedly sending large volumes of ICMP echo request packets to a broadcast address. Which type of attack is this indicative of?
⚠ Common exam trap
EC-CEH often tests the distinction between Smurf and Ping of Death, where candidates confuse the volume-based amplification of Smurf with the oversized-packet exploit of Ping of Death.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Smurf attack
A Smurf attack is a distributed denial-of-service (DDoS) attack that exploits ICMP echo request packets sent to a network broadcast address. The source IP is spoofed to be the victim's address, causing all hosts on the broadcast network to reply to the victim, overwhelming it with ICMP echo replies. This matches the alert description of large volumes of ICMP echo requests to a broadcast address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Smurf attack
Why this is correct
A Smurf attack is a distributed denial-of-service (DDoS) attack where an attacker sends a large number of Internet Control Message Protocol (ICMP) echo requests to a network's broadcast address. The crucial element is that the source IP address of these requests is spoofed to be the victim's workstation. Consequently, all hosts on the broadcast network respond to the victim's IP address with ICMP echo replies, overwhelming the workstation with traffic and causing a denial of service.
- ✗
Ping of Death
Why it's wrong here
The Ping of Death is an older denial-of-service attack that exploits vulnerabilities in how systems handle oversized ICMP packets. An attacker sends an ICMP echo request packet larger than the maximum allowed IP packet size (65,535 bytes). When the target system attempts to reassemble the fragmented, oversized packet, it can lead to a buffer overflow, system crash, or reboot, rather than a flood of responses from other network devices.
- ✗
SYN flood
Why it's wrong here
A SYN flood is a denial-of-service attack that exploits the TCP three-way handshake. The attacker sends a rapid succession of TCP SYN (synchronize) requests to a target server but never completes the handshake with the final ACK packet. This leaves the server with numerous half-open connections, exhausting its connection table and preventing legitimate clients from establishing new connections, primarily targeting server resources rather than a workstation receiving reflected traffic.
- ✗
Slowloris
Why it's wrong here
Slowloris is an application-layer denial-of-service attack designed to exhaust a web server's connection pool by holding open as many connections as possible. It achieves this by sending legitimate but incomplete HTTP requests to the target server and then periodically sending small, non-threatening HTTP headers to keep the connections alive. This ties up server resources, making it unavailable to legitimate users, and is distinct from network-layer reflection or amplification attacks.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.