CEH Practice Question: Malware, Social Engineering and Network Attacks

A SOC analyst observes a high number of incomplete TCP connections with the SYN flag set but no corresponding ACK from the target. The source IPs are spoofed and the connections are targeting port 80 on a web server. Which DDoS mitigation technique would be MOST effective in this scenario?

⚠ Common exam trap

A common mix-up: candidates choose 'Ingress filtering' because it addresses spoofed IPs, but they miss that the question asks for a mitigation technique during an ongoing attack, not a long-term preventive measure.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

SYN cookies

SYN cookies are the most effective mitigation against SYN flood attacks because they allow the server to avoid allocating resources for half-open connections until the handshake is completed. When the SYN queue is full, the server generates a cookie based on the connection parameters and sends it in the SYN-ACK; only when the client returns a valid ACK with the cookie does the server establish the connection. This technique prevents resource exhaustion from spoofed SYN packets targeting port 80.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
SYN cookies
Why this is correct
SYN cookies are a highly effective defense against SYN flood attacks, which cause a high number of incomplete TCP connections. This mechanism encodes all necessary connection state information into the SYN-ACK sequence number, allowing the server to avoid allocating resources (like Transmission Control Blocks) until the client sends a valid final ACK. By deferring state allocation, the server prevents resource exhaustion from half-open connections, only committing resources for fully established sessions.
✗
Rate limiting
Why it's wrong here
Rate limiting can reduce the overall volume of traffic reaching a server or network, potentially mitigating some aspects of a flood. However, it does not specifically address the resource exhaustion caused by incomplete TCP handshakes, which is the core problem in a SYN flood. While it might drop excessive SYN packets, it doesn't prevent the server from allocating resources for the SYN-ACKs it does send, nor does it validate the legitimacy of the connection attempts.
✗
Anycast distribution
Why it's wrong here
Anycast distribution is a network routing technique that directs traffic for a single IP address to the topologically nearest server among a group of servers. While beneficial for load balancing and improving availability across multiple data centers, it does not inherently prevent or mitigate SYN flood attacks. Each individual server within the Anycast group remains susceptible to SYN exhaustion if it receives a high volume of incomplete TCP connection attempts, as Anycast simply distributes traffic, not filters or validates it.
✗
Ingress filtering
Why it's wrong here
Ingress filtering is a network security practice implemented at the network's edge, typically by ISPs or organizational border routers, to block incoming traffic with spoofed source IP addresses. While crucial for preventing source IP spoofing and making SYN floods harder to trace, it is a preventative measure applied upstream. In the scenario described, the high number of incomplete TCP connections indicates the attack packets have already reached the target server, rendering ingress filtering an ineffective direct solution for an ongoing SYN flood at the server level.

Visual reference

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question