CEH Practice Question: Malware, Social Engineering and Network Attacks
Which TWO of the following are examples of application layer (Layer 7) DDoS attacks? (Select 2)
⚠ Common exam trap
A common mix-up: candidates confuse SYN flood (Layer 4) with application-layer attacks because both involve flooding, but SYN flood targets the TCP handshake at the transport layer, not the HTTP protocol at Layer 7.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HTTP flood
HTTP flood is a Layer 7 DDoS attack because it targets the application layer by sending seemingly legitimate HTTP GET or POST requests to overwhelm a web server's resources. Unlike network-layer attacks, HTTP flood exploits the server's ability to process requests, often mimicking normal user behavior to bypass basic rate limiting. Slowloris is also a Layer 7 attack that works by opening multiple HTTP connections and keeping them open with partial requests, exhausting the server's connection pool without completing the handshake.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
HTTP flood
Why this is correct
An HTTP flood is a Layer 7 (Application Layer) Distributed Denial of Service (DDoS) attack that overwhelms a web server by sending a massive volume of legitimate-looking HTTP GET or POST requests. These requests consume the server's CPU, memory, and bandwidth resources, making it unable to respond to legitimate user traffic. Unlike lower-layer attacks, it targets the specific application protocol, mimicking normal user behavior to evade simple network-level defenses.
- ✗
Smurf attack
Why it's wrong here
A Smurf attack is a Layer 3 (Network Layer) Denial of Service (DoS) attack that leverages ICMP echo requests and IP broadcast addresses. The attacker sends a large number of ICMP echo requests to a network's broadcast address, spoofing the victim's IP address as the source. This causes all hosts on that network to reply to the victim, flooding their network connection with ICMP echo replies and rendering their services unavailable.
- ✗
SYN flood
Why it's wrong here
A SYN flood is a Layer 4 (Transport Layer) DoS attack that exploits the TCP three-way handshake mechanism. The attacker sends a rapid succession of SYN requests to a target server but never completes the handshake by sending the final ACK packet. This leaves the server with numerous half-open connections, exhausting its connection table and preventing legitimate clients from establishing new TCP connections.
- ✗
UDP flood
Why it's wrong here
A UDP flood is a Layer 4 (Transport Layer) volumetric DoS attack where the attacker sends a large number of User Datagram Protocol (UDP) packets to random ports on a target server. The server attempts to process these packets, and for each closed port, it typically sends an ICMP 'Destination Unreachable' packet back to the spoofed source. This consumes significant server resources and outbound bandwidth, leading to service degradation or complete unavailability.
- ✓
Slowloris
Why this is correct
Slowloris is a Layer 7 (Application Layer) DoS attack designed to exhaust a web server's connection pool by opening and maintaining many concurrent HTTP connections. It achieves this by sending partial HTTP requests, such as incomplete headers, and then periodically sending small amounts of data to keep the connection alive. This ties up server threads and resources, preventing new legitimate connections from being established and ultimately denying service to other users.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.