CEH Practice Question: Malware, Social Engineering and Network Attacks

Which TWO of the following are examples of amplification attacks used in DDoS?

⚠ Common exam trap

The CEH exam often tests the distinction between 'amplification attacks' (which multiply traffic via a small request to a third-party server) and 'flood attacks' (which directly overwhelm with many packets of similar size), so candidates mistakenly classify SYN flood or Ping of Death as amplification when they are not.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

DNS amplification

DNS amplification is a classic DDoS amplification attack where an attacker sends a small DNS query (e.g., an ANY or TXT record request) with a spoofed source IP (the victim's address) to an open DNS resolver. The resolver responds with a much larger response (up to 50x the query size), flooding the victim with traffic. This exploits the UDP protocol's lack of handshake and the resolver's willingness to respond to any source.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
DNS amplification
Why this is correct
DNS amplification is a type of Distributed Denial-of-Service (DDoS) attack that leverages open DNS resolvers. An attacker spoofs the victim's IP address and sends small DNS queries to numerous vulnerable DNS servers. These servers then respond with significantly larger DNS records, often hundreds of times the size of the initial query, directing this amplified traffic to the spoofed victim, overwhelming their network bandwidth. This attack exploits the stateless nature of UDP.
✓
NTP amplification
Why this is correct
NTP amplification attacks exploit Network Time Protocol (NTP) servers, particularly those with the `monlist` command enabled. An attacker sends a small UDP request with a spoofed source IP (the victim's) to an NTP server, requesting the `monlist` of recent client connections. The NTP server responds with a large list of up to 600 entries, generating a response packet that can be many times larger than the initial query, thus amplifying the traffic directed at the victim.
✗
Slowloris
Why it's wrong here
Slowloris is an application-layer (Layer 7) denial-of-service attack designed to exhaust a web server's connection pool. It operates by opening numerous partial HTTP connections to the target server and then slowly sending subsequent HTTP headers. This keeps the connections open indefinitely, preventing other legitimate users from connecting, but it does not involve amplifying traffic volume; instead, it consumes server resources through prolonged, incomplete requests.
✗
SYN flood
Why it's wrong here
A SYN flood is a classic Layer 4 (TCP) denial-of-service attack that exploits the three-way handshake. The attacker sends a high volume of SYN requests to the target server, often with spoofed source IP addresses. The server responds with SYN-ACK packets and allocates resources for these half-open connections, awaiting the final ACK. Since the ACK never arrives from the spoofed source, the server's connection table becomes exhausted, preventing legitimate connections, but without amplifying data volume.
✗
Ping of Death
Why it's wrong here
The Ping of Death is an older, specific type of denial-of-service attack that exploits vulnerabilities in a system's IP fragmentation and reassembly process. It involves sending an ICMP echo request (ping) packet that is intentionally malformed to exceed the maximum allowed IP packet size (65,535 bytes) when reassembled. This oversized packet could cause buffer overflows, crashes, or system instability on vulnerable targets, but it does not amplify the volume of traffic.

Visual reference

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question