CEH Practice Question: Malware, Social Engineering and Network Attacks
An analyst observes that a web server is receiving many HTTP GET requests with random parameter values, each request taking a long time to complete. The server's connection pool is exhausted, and legitimate users cannot access the site. Which attack is MOST likely occurring?
⚠ Common exam trap
A common mix-up: candidates confuse Slowloris with an HTTP flood because both use HTTP GET requests, but Slowloris specifically exploits incomplete requests to hold connections open, whereas an HTTP flood relies on high request volume.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Slowloris
Slowloris is a low-and-slow application-layer DoS attack that opens multiple HTTP connections to the target server and keeps them alive by sending partial HTTP GET requests with random parameters, never completing the request. This exhausts the server's connection pool, preventing legitimate users from connecting, while each request takes a long time due to the server waiting for the final headers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
UDP flood
Why it's wrong here
A UDP flood is a denial-of-service attack that overwhelms a target server or network with a large volume of User Datagram Protocol (UDP) packets. Unlike HTTP requests, which operate over TCP at the application layer, UDP is a connectionless transport layer protocol. This attack typically targets services listening on UDP ports, such as DNS or NTP, by sending spoofed UDP packets to exhaust network bandwidth or server resources, not by sending HTTP requests to a web server.
- ✗
SYN flood
Why it's wrong here
A SYN flood is a classic denial-of-service attack that exploits the TCP three-way handshake. The attacker sends a high volume of TCP SYN (synchronize) packets to the target server but never completes the handshake with the final ACK packet, often by using spoofed source IP addresses. This leaves the server with many half-open connections, exhausting its connection table and preventing legitimate clients from establishing new TCP sessions, which is distinct from sending application-layer HTTP requests.
- ✓
Slowloris
Why this is correct
Slowloris is an application-layer denial-of-service attack designed to exhaust a web server's connection pool by holding open as many connections as possible for as long as possible. It achieves this by sending legitimate, but incomplete, HTTP requests, such as a partial GET request followed by sending additional HTTP headers at very slow intervals. This forces the server to keep these connections open, waiting for the full request, eventually preventing new legitimate connections from being established and rendering the server inaccessible.
- ✗
HTTP flood
Why it's wrong here
An HTTP flood is an application-layer denial-of-service attack that overwhelms a web server by sending a massive volume of seemingly legitimate, *complete* HTTP GET or POST requests. Unlike Slowloris, which focuses on holding connections open with incomplete requests, an HTTP flood aims to consume the server's CPU and memory resources by forcing it to process and respond to each full request. This rapid succession of valid requests can exhaust server capacity, leading to slow responses or complete unavailability for legitimate users.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.