Question 534 of 870
What Is a DNS Amplification Attack? DDoS Example
An organization experiences a DDoS attack where a large volume of DNS queries with spoofed source IPs are sent to open DNS resolvers, which then amplify the traffic to the victim. Which type of attack is this?
Quick Answer
The answer is a DNS amplification attack, a specific type of volumetric DDoS where the attacker sends small DNS queries with spoofed source IPs to open resolvers, which then generate large responses directed at the victim. This works because a tiny query, often just a few dozen bytes, can trigger a response hundreds of times larger, and the attacker multiplies this effect by using many resolvers simultaneously. On the Certified Ethical Hacker CEH exam, this scenario tests your understanding of amplification vectors and the abuse of UDP’s connectionless nature, often appearing in questions about network-layer DDoS techniques. A common trap is confusing this with a simple DNS flood, but the key distinction is the amplification factor—the attacker leverages the resolver’s response size, not just query volume. Memory tip: think “small query, big response, many resolvers” to recall the amplification chain.
⚠ Common exam trap
In EC-CEH, candidates often mistake DNS amplification for a basic UDP flood or Smurf attack. The key is to recognize the involvement of an open DNS resolver and the amplification factor, which are hallmarks of this attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS amplification
This is a DNS amplification attack, a type of DDoS that exploits open DNS resolvers. The attacker sends a small DNS query (e.g., ANY type) with a spoofed source IP (the victim's IP) to an open resolver, which responds with a much larger response (up to 50-100x the query size), flooding the victim. The key mechanism is the amplification factor combined with the spoofed source address, which directs the amplified traffic to the victim.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
UDP flood
Why it's wrong here
UDP flood sends UDP packets to random ports, not specifically DNS amplification.
- ✗
Smurf attack
Why it's wrong here
Smurf attack uses ICMP echo requests to broadcast addresses.
- ✗
SYN flood
Why it's wrong here
SYN flood is a TCP protocol attack, not using DNS.
- ✓
DNS amplification
Why this is correct
Uses open DNS resolvers to amplify traffic to the victim.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which DDoS attack type exploits a small query to a vulnerable service that generates a large response directed at the victim?
medium- ✓ A.Amplification attack
- B.HTTP flood
- C.SYN flood
- D.ICMP flood
Why A: An amplification attack is correct because it exploits a small query (e.g., a DNS lookup with a spoofed source IP) sent to a vulnerable service like an open DNS resolver or NTP server, which then generates a large response (e.g., 50-100x the query size) directed at the victim. This leverages the protocol's amplification factor and the lack of source IP validation, overwhelming the victim's bandwidth. The attack is a type of reflection attack, where the intermediary service unwittingly amplifies traffic toward the target.
Last reviewed: Jul 4, 2026
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.