CEH Practice Question: Malware, Social Engineering and Network Attacks
An organization experiences a DDoS attack where the attacker sends a flood of UDP packets to a server, causing it to become unresponsive. The packets appear to come from many different source IP addresses and are directed to random high-numbered ports. Which type of DDoS attack is this?
⚠ Common exam trap
A common mix-up: candidates confuse a UDP flood with a SYN flood because both involve flooding and spoofed IPs, but the key differentiator is the transport layer protocol (UDP vs. TCP) and the use of random high-numbered ports versus specific TCP ports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
UDP flood
A UDP flood attack works by overwhelming a target server with a high volume of UDP packets sent to random high-numbered ports. The server checks each port for a listening application, and when none is found, it responds with ICMP Destination Unreachable messages, consuming CPU and bandwidth until the server becomes unresponsive. The use of spoofed source IP addresses makes it difficult to filter the attack traffic based on source alone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ICMP flood
Why it's wrong here
An ICMP flood, often called a "ping flood," overwhelms a target by sending a massive volume of ICMP echo request packets. The victim's system expends significant resources attempting to process and respond to each request, consuming network bandwidth and CPU cycles. This attack specifically leverages the Internet Control Message Protocol (ICMP), which is distinct from the User Datagram Protocol (UDP) described in the scenario, making it an incorrect match.
- ✓
UDP flood
Why this is correct
A UDP flood attack involves sending a high volume of User Datagram Protocol (UDP) datagrams to random high-numbered ports on a target server. The server then attempts to identify which application, if any, is listening on each port. When no application is found, the server typically generates an ICMP "Destination Unreachable" packet in response. This continuous process consumes significant server resources, including CPU cycles and outgoing network bandwidth, leading to service degradation or denial for legitimate users, precisely matching the described scenario.
- ✗
SYN flood
Why it's wrong here
A SYN flood targets the TCP three-way handshake by exhausting connection queues with half-open states, but the scenario specifies UDP packets to random high-numbered ports, which lack handshake mechanics entirely. This option is tempting because SYN floods are a common volumetric attack that also spoofs source IPs and overwhelms servers, making it a plausible misidentification if one overlooks the protocol mismatch.
- ✗
Smurf attack
Why it's wrong here
A Smurf attack relies on ICMP echo requests sent to a network’s broadcast address, not a flood of UDP packets to random high-numbered ports; the scenario explicitly describes UDP traffic, so the amplification mechanism of Smurf—which uses ICMP—does not apply. It is tempting because Smurf also spoofs the victim’s source IP to generate many responses, but that technique targets the victim indirectly via broadcast replies, whereas this attack directly saturates the server with UDP datagrams.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.