Question 23 of 870
Detecting DNS Amplification Attacks
An IDS alerts on a large number of outbound DNS queries from an internal host to a suspicious domain. The queries have random subdomains and the response size is large. Which attack is MOST likely in progress?
Quick Answer
The answer is a DNS amplification attack. This is the correct choice because the attack leverages open DNS resolvers to send large response packets to a spoofed victim IP, and the random subdomains are specifically crafted to bypass caching and force the resolver to query authoritative servers, generating maximum response size. On the Certified Ethical Hacker CEH exam, this scenario tests your ability to distinguish amplification attacks from other DDoS variants like NTP or Smurf attacks; a common trap is confusing the internal host’s outbound queries with the victim’s traffic, but remember the internal host here is acting as a reflector, not the target. For a memory tip, think “random subdomains + large responses = DNS amplification,” and recall that the attacker spoofs the victim’s IP to make the resolver send the oversized reply to the victim, not the attacker.
⚠ Common exam trap
Many candidates confuse DNS tunneling with DNS amplification because both involve DNS queries, but the key differentiator is the large response size in amplification versus the small, covert data payloads in tunneling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS amplification attack
The described behavior—large numbers of outbound DNS queries with random subdomains and large response sizes—is the hallmark of a DNS amplification attack. In this attack, the attacker spoofs the victim's IP address and sends queries with random subdomains to open DNS resolvers, which then send large responses (often 10x to 50x larger than the query) to the victim, overwhelming their bandwidth. The IDS alerts on the outbound queries from the internal host because that host is the victim receiving the amplified responses, not the attacker.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Slowloris attack
Why it's wrong here
Slowloris is an application-layer DDoS attack that holds connections open, not DNS-based.
- ✗
UDP flood
Why it's wrong here
UDP flood sends many UDP packets to random ports, not specifically DNS.
- ✓
DNS amplification attack
Why this is correct
Correct. The large responses and random subdomains indicate an amplification attack.
- ✗
DNS tunneling
Why it's wrong here
DNS tunneling encodes data in DNS queries, but the large response size suggests amplification.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are characteristics of a DNS amplification DDoS attack? (Select three.)
hard- ✓ A.Spoofs the source IP address of the victim
- ✓ B.Amplifies traffic by sending small queries that generate large responses
- ✓ C.Uses open DNS resolvers
- D.Exploits the TCP handshake process
- E.Floods the target with small ICMP packets
Why A: In a DNS amplification DDoS attack, the attacker spoofs the source IP address of the victim in DNS queries sent to open resolvers. This causes the resolvers to send their large responses to the victim, not the attacker, thereby directing the amplified traffic at the target. Without IP spoofing, the attack would not be able to flood the victim with responses.
Variation 2. Which TWO of the following are characteristics of a DNS amplification attack? (Select 2)
medium- A.It targets the victim's MAC address
- ✓ B.It uses spoofed source IP addresses
- ✓ C.It exploits open DNS resolvers
- D.It requires the attacker to be on the same subnet as the victim
- E.It uses ICMP echo requests
Why B: DNS amplification attacks rely on sending DNS queries with a spoofed source IP address that matches the victim's IP. The attacker sends small queries to open DNS resolvers, which then send large responses to the victim, overwhelming their bandwidth. This spoofing ensures the amplified traffic is directed at the victim, not the attacker.
Last reviewed: Jul 4, 2026
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.