CEH Network and Web Application Attacks Practice Question
As a network defender, you notice an unusually high number of incomplete TCP three-way handshakes from a single external IP to multiple internal hosts. What is the most likely attack taking place?
⚠ Common exam trap
EC-Council often tests the distinction between a SYN flood and a UDP flood, where candidates mistakenly choose UDP flood because they associate 'flood' with any high-volume attack, but the key clue is the incomplete TCP three-way handshake, which is specific to SYN floods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SYN flood
A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to target hosts without completing the handshake (i.e., not sending the final ACK). This leaves the target with half-open connections, exhausting its connection table and denying service to legitimate traffic. The observation of incomplete handshakes from a single external IP to multiple internal hosts is a classic signature of a SYN flood.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
UDP flood
Why it's wrong here
UDP flood uses UDP packets, not TCP SYN packets.
- ✓
SYN flood
Why this is correct
SYN flood sends many SYN packets without completing handshake.
- ✗
ARP spoofing
Why it's wrong here
ARP spoofing operates at layer 2, not TCP handshake.
- ✗
ICMP flood
Why it's wrong here
ICMP flood uses ping requests, not TCP handshake packets.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.