CEH Practice Question: Malware, Social Engineering and Network Attacks
Which THREE of the following are characteristics of a DNS amplification DDoS attack? (Select three.)
⚠ Common exam trap
EC-CEH often tests the distinction between UDP-based amplification attacks and TCP-based attacks; the trap here is that candidates may confuse DNS amplification with a SYN flood or other TCP-based attacks, mistakenly selecting Option D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Spoofs the source IP address of the victim
In a DNS amplification DDoS attack, the attacker spoofs the source IP address of the victim in DNS queries sent to open resolvers. This causes the resolvers to send their large responses to the victim, not the attacker, thereby directing the amplified traffic at the target. Without IP spoofing, the attack would not be able to flood the victim with responses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Spoofs the source IP address of the victim
Why this is correct
In a DNS amplification attack, the attacker crafts DNS queries but sets the source IP address of these queries to that of the intended victim. This IP spoofing is fundamental because it ensures that when the legitimate, but often misconfigured, DNS resolvers respond to these queries, the large response packets are directed back to the victim's IP address, effectively flooding their network interface. Without source IP spoofing, the amplified traffic would return to the attacker, defeating the purpose of the denial-of-service attack.
- ✓
Amplifies traffic by sending small queries that generate large responses
Why this is correct
A core characteristic of DNS amplification is its ability to magnify the attack traffic. Attackers send small, specially crafted DNS queries, such as those requesting "ANY" records or DNSSEC-signed records, to vulnerable DNS resolvers. These small queries trigger significantly larger responses from the resolvers, sometimes by a factor of 70x or more, which are then directed towards the spoofed victim, thereby amplifying the impact of the attack with minimal bandwidth from the attacker.
- ✓
Uses open DNS resolvers
Why this is correct
DNS amplification attacks critically rely on the existence of open DNS resolvers, which are DNS servers configured to respond to recursive queries from any source IP address on the internet, not just internal clients. These misconfigured servers become unwitting participants in the attack, processing the spoofed queries and sending the amplified responses to the victim, making them a key component in the attacker's infrastructure for launching distributed denial-of-service attacks.
- ✗
Exploits the TCP handshake process
Why it's wrong here
This statement is incorrect because DNS amplification attacks primarily exploit the User Datagram Protocol (UDP), specifically port 53, for their operation. UDP is a connectionless protocol, which allows attackers to spoof source IP addresses easily without needing to complete a three-way handshake, unlike TCP. The absence of a handshake in UDP is crucial for the attack's effectiveness, as it prevents the resolver from verifying the legitimacy of the spoofed source IP.
- ✗
Floods the target with small ICMP packets
Why it's wrong here
This option is incorrect as DNS amplification attacks specifically leverage the DNS protocol over UDP, not ICMP. While ICMP flood attacks (like a Smurf attack or ping flood) do exist and aim to overwhelm a target with ICMP echo requests or replies, they operate on a different protocol and mechanism. DNS amplification focuses on the large response size of DNS queries to generate high-bandwidth traffic, distinct from the small packet size characteristic of typical ICMP floods.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.