CEH Practice Question: Malware, Social Engineering and Network Attacks
Which TWO of the following are characteristics of a DNS amplification attack? (Select 2)
⚠ Common exam trap
Test-takers frequently confuse DNS amplification with other reflection attacks like Smurf (which uses ICMP) or think the attacker must be local, but the key differentiator is the use of spoofed source IPs and open DNS resolvers over UDP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It uses spoofed source IP addresses
DNS amplification attacks rely on sending DNS queries with a spoofed source IP address that matches the victim's IP. The attacker sends small queries to open DNS resolvers, which then send large responses to the victim, overwhelming their bandwidth. This spoofing ensures the amplified traffic is directed at the victim, not the attacker.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It targets the victim's MAC address
Why it's wrong here
DNS amplification is a network-layer (Layer 3) and application-layer (Layer 7) attack, not a data link layer (Layer 2) attack. MAC addresses are physical addresses used for local network communication within a single broadcast domain. Since DNS amplification attacks are typically launched across the internet to overwhelm a victim's internet connection or services, targeting a MAC address is irrelevant and technically impossible for a remote attack of this nature. The attack focuses on IP addresses and network bandwidth.
- ✓
It uses spoofed source IP addresses
Why this is correct
This is a critical characteristic of DNS amplification. The attacker sends small DNS queries to numerous open DNS resolvers, but crafts these queries to appear as if they originated from the victim's IP address. This IP spoofing ensures that when the resolvers send their much larger responses, they are directed to the legitimate victim's network, effectively overwhelming their bandwidth and causing a denial of service. Without spoofing, the responses would return to the attacker, nullifying the amplification effect.
- ✓
It exploits open DNS resolvers
Why this is correct
Open DNS resolvers are fundamental to the success of a DNS amplification attack. These are DNS servers that are misconfigured to accept and process recursive queries from any source IP address on the internet, rather than restricting service to trusted clients. Attackers leverage these servers by sending them small, specially crafted DNS queries that elicit significantly larger responses, thereby multiplying the volume of traffic directed at the spoofed victim's IP address.
- ✗
It requires the attacker to be on the same subnet as the victim
Why it's wrong here
This statement is incorrect because DNS amplification attacks are designed to be launched remotely, often from anywhere on the internet. The attacker's ability to spoof the victim's IP address and direct traffic through open resolvers means there is no requirement for them to be in the same local network or subnet as the target. The attack operates at the network layer and above, utilizing global internet routing rather than local network proximity.
- ✗
It uses ICMP echo requests
Why it's wrong here
DNS amplification attacks specifically utilize the User Datagram Protocol (UDP) and the DNS protocol (typically on port 53) to generate and reflect traffic. ICMP echo requests, commonly known as "pings," are part of the Internet Control Message Protocol and are used in different types of denial-of-service attacks, such as Smurf attacks or simple ping floods. They are not the mechanism employed in a DNS amplification attack, which relies on the inherent amplification factor of DNS queries and responses.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.