Application-Layer DDoS Attacks: Slowloris and HTTP Flood
Which TWO of the following are examples of application-layer DDoS attacks? (Choose two.)
Quick Answer
The correct answer is HTTP flood, along with Slowloris, as both are classic examples of application-layer DDoS attacks. These attacks target Layer 7 of the OSI model, where they exhaust server resources by mimicking legitimate user requests—HTTP flood overwhelms a server with seemingly valid GET or POST requests, while Slowloris opens many connections and keeps them hanging by sending partial headers. On the Certified Ethical Hacker CEH exam, this distinction tests your ability to classify attacks by OSI layer; a common trap is confusing application-layer attacks with protocol or volumetric ones, such as SYN flood (Layer 4) or UDP flood (Layer 3). To remember, think of the “application” layer as the one closest to the user—attacks here look like normal traffic but are designed to tie up server threads or fill connection pools. A useful memory tip: “Slow and HTTP both speak HTTP,” meaning they operate at the application layer where HTTP lives, unlike SYN or Smurf which abuse lower-level protocols.
⚠ Common exam trap
Candidates often confuse transport-layer attacks (like SYN floods and UDP floods) with application-layer attacks, because both can cause denial of service, but only application-layer attacks target specific protocols like HTTP, DNS, or SMTP at Layer 7.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Slowloris
Slowloris is an application-layer DDoS attack that works by opening multiple HTTP connections to a target web server and keeping them alive indefinitely by sending partial HTTP requests. This exhausts the server's connection pool, preventing legitimate users from connecting. It specifically targets the HTTP protocol at Layer 7, making it an application-layer attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
UDP flood
Why it's wrong here
UDP flood is a volumetric attack at the transport layer.
- ✓
Slowloris
Why this is correct
Slowloris is an application-layer attack that consumes server resources by keeping many connections open.
- ✓
HTTP flood
Why this is correct
HTTP flood sends many legitimate HTTP requests to overwhelm the application.
- ✗
SYN flood
Why it's wrong here
SYN flood is a protocol attack at the transport layer.
- ✗
Smurf attack
Why it's wrong here
Smurf is a protocol attack at the network layer.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
7 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are examples of application layer (Layer 7) DDoS attacks? (Select 2)
medium- ✓ A.HTTP flood
- B.Smurf attack
- C.SYN flood
- D.UDP flood
- ✓ E.Slowloris
Why A: HTTP flood is a Layer 7 DDoS attack because it targets the application layer by sending seemingly legitimate HTTP GET or POST requests to overwhelm a web server's resources. Unlike network-layer attacks, HTTP flood exploits the server's ability to process requests, often mimicking normal user behavior to bypass basic rate limiting. Slowloris is also a Layer 7 attack that works by opening multiple HTTP connections and keeping them open with partial requests, exhausting the server's connection pool without completing the handshake.
Variation 2. Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)
medium- ✓ A.HTTP flood
- B.ICMP flood
- C.SYN flood
- D.UDP flood
- ✓ E.Slowloris
Why A: HTTP flood is an application-layer DDoS attack because it targets the HTTP protocol (Layer 7) by overwhelming a web server with seemingly legitimate GET or POST requests. Unlike network-layer attacks, HTTP flood exploits the server's processing of application-layer requests, often mimicking normal user behavior to bypass basic rate limiting. This forces the server to allocate resources for each request, eventually exhausting connection pools or CPU cycles. Similarly, Slowloris is also an application-layer DDoS attack that targets web servers by holding open many HTTP connections for as long as possible, sending only partial requests. This exhausts the server's concurrent connection pool, preventing legitimate users from connecting. Both attacks operate at Layer 7, exploiting the application's resource handling rather than just raw bandwidth.
Variation 3. Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)
medium- A.UDP flood
- ✓ B.HTTP flood
- ✓ C.Slowloris
- D.ICMP flood
- E.SYN flood
Why B: B is correct because an HTTP flood attack sends a high volume of seemingly legitimate HTTP GET or POST requests to a web server, overwhelming its connection pool and CPU resources. This targets the application layer (Layer 7) of the OSI model, as it exploits the HTTP protocol's request-handling logic rather than network-layer bandwidth.
Variation 4. Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)
medium- ✓ A.Slowloris
- B.SYN flood
- C.Smurf attack
- D.UDP flood
- ✓ E.HTTP flood
Why A: Slowloris is an application-layer DDoS attack that targets web servers by opening multiple HTTP connections and keeping them alive with partial requests, sending headers periodically to prevent timeout. It exploits the server's connection handling at Layer 7, exhausting the connection pool without requiring high bandwidth.
Variation 5. Which TWO of the following are examples of application layer DDoS attacks? (Select two.)
medium- ✓ A.Slowloris
- B.UDP flood
- C.Smurf attack
- ✓ D.HTTP flood
- E.SYN flood
Why A: Slowloris is an application layer DDoS attack that targets HTTP servers by opening multiple connections and sending partial HTTP requests, keeping them open as long as possible. It exploits the server's connection handling by sending incomplete headers, preventing the server from timing out the connection and exhausting its connection pool. This attack operates at Layer 7 and does not require high bandwidth, making it effective against web servers.
Variation 6. Which THREE of the following are examples of application-layer DDoS attacks? (Select 3)
hard- ✓ A.Slowloris
- ✓ B.HTTP flood
- C.SYN flood
- ✓ D.DNS amplification
- E.UDP flood
Why A: Slowloris is an application-layer DDoS attack that targets web servers by opening multiple HTTP connections and keeping them alive with partial requests, sending headers slowly to exhaust the server's connection pool. It exploits the HTTP protocol's design where servers wait for complete requests before releasing resources, making it a classic Layer 7 attack.
Variation 7. Which TWO of the following are examples of application-layer DDoS attacks?
medium- A.ICMP flood
- ✓ B.Slowloris
- C.SYN flood
- ✓ D.HTTP flood
- E.UDP flood
Why B: Slowloris is an application-layer DDoS attack that works by opening multiple HTTP connections to a target web server and keeping them alive indefinitely by sending partial HTTP headers at regular intervals. This exhausts the server's connection pool, preventing legitimate users from connecting. HTTP flood attacks involve sending a large volume of legitimate-looking HTTP requests (GET/POST) to a web server, overwhelming its resources and preventing it from responding to legitimate users. Both attacks specifically target the HTTP protocol at Layer 7, exploiting application-layer vulnerabilities rather than network or transport layer protocols.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.