CEH Network and Web Application Attacks Practice Question
Exhibit
C:\Users\admin>netstat -ano | findstr :80 TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 1234 TCP 10.1.1.5:443 10.2.2.3:54321 ESTABLISHED 5678 TCP 10.1.1.5:443 10.2.2.4:12345 TIME_WAIT 0 TCP 10.1.1.5:443 10.2.2.5:9876 ESTABLISHED 5678 C:\Users\admin>tasklist | findstr 5678 pid.exe 5678 Console 1 2,456 K
Refer to the exhibit. A security analyst notices multiple ESTABLISHED connections on port 443 from different external IPs to the same process ID. What type of attack is most likely occurring?
⚠ Common exam trap
In EC-CEH, the distinction between a DDoS (multiple source IPs) and a DoS (single source IP) is critical. Candidates may confuse a DDoS with a Slowloris attack because both involve many connections, but Slowloris uses incomplete requests from few sources, not fully ESTABLISHED connections from many IPs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Distributed denial-of-service (DDoS) attack
Multiple ESTABLISHED connections on port 443 (HTTPS) from different external IPs to the same process ID indicate a distributed denial-of-service (DDoS) attack. In a DDoS, many compromised hosts (botnet) simultaneously establish legitimate TCP handshakes and maintain connections to exhaust server resources, such as connection slots or memory, at the application layer. The key clue is the diversity of source IPs targeting a single process, which is characteristic of a coordinated flood from many distinct sources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Distributed denial-of-service (DDoS) attack
Why this is correct
The observation of numerous distinct external IP addresses simultaneously establishing connections to a single server process on port 443 strongly indicates a Distributed Denial-of-Service (DDoS) attack. This type of attack aims to overwhelm the target server's resources, such as network bandwidth, CPU, or memory, by flooding it with a high volume of seemingly legitimate connection requests. The distributed nature, originating from multiple sources, makes it difficult to block individual malicious IPs and effectively exhausts the server's capacity to handle legitimate traffic.
- ✗
SSL/TLS renegotiation DoS
Why it's wrong here
An SSL/TLS renegotiation DoS specifically exploits the resource-intensive process of re-establishing cryptographic parameters within an existing secure session. This attack involves repeatedly requesting renegotiations, forcing the server to expend significant CPU cycles on cryptographic operations, leading to resource exhaustion. However, the scenario describes multiple *established* connections from distinct IPs, not a pattern of repeated renegotiation requests, which is the hallmark of this particular DoS vector.
- ✗
Slowloris attack
Why it's wrong here
A Slowloris attack operates by opening many incomplete HTTP connections to a web server, sending partial requests to keep these connections alive for as long as possible. This ties up the server's available connection threads, preventing legitimate users from establishing new connections. The key discrepancies here are that Slowloris typically targets HTTP (port 80) with incomplete requests and often from a single source, whereas the exhibit shows established connections on port 443 from multiple distinct IP addresses.
- ✗
Man-in-the-middle attack
Why it's wrong here
A Man-in-the-Middle (MITM) attack involves an attacker secretly relaying and possibly altering the communication between two parties who believe they are directly communicating with each other. This attack focuses on intercepting and manipulating data flow, not on overwhelming a single server with a high volume of direct connection attempts from multiple disparate sources. The observed pattern of numerous external IPs connecting to one server is a direct assault on availability, not an interception of existing communication.
Visual reference
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.