ISC2 CC Network Security Practice Question
An analyst reviewing traffic captures sees a workstation repeatedly sending TCP packets with the SYN flag set to many different destination ports on a single server, but the workstation never completes the three-way handshake. The server's connection table is becoming exhausted. Which type of activity is most likely occurring?
⚠ Common exam trap
The trap here is assuming any flood of packets is a bandwidth exhaustion attack, when the incomplete TCP handshakes specifically point to resource exhaustion of the connection table.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A SYN flood denial-of-service attack
The repeated SYN packets without completed handshakes indicate a SYN flood, a denial-of-service technique that exhausts a server's pending connection queue. The server cannot complete legitimate connections because its backlog is full. Other attacks would involve different protocols or completed sessions, so the half-open TCP pattern is the key differentiator.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A man-in-the-middle attack intercepting session traffic
Why it's wrong here
A man-in-the-middle attack typically involves traffic redirection or interception, such as ARP poisoning or rogue proxies, and would show established sessions being relayed. The scenario shows only incomplete handshakes, which is inconsistent with an interception that requires completed connections. No evidence of altered or relayed traffic is present.
- ✗
A smurf amplification attack using ICMP
Why it's wrong here
A smurf attack uses ICMP echo requests sent to a broadcast address with a spoofed source, causing many hosts to reply to the victim. The scenario describes TCP SYN packets, not ICMP, and no broadcast behavior is mentioned. Thus the observed traffic does not align with ICMP-based amplification.
- ✓
A SYN flood denial-of-service attack
Why this is correct
The half-open connections with SYN set and no completed handshake are the signature of a SYN flood, where the attacker exhausts the server's backlog of pending connections. Because the source addresses are often spoofed, the final ACK never arrives, leaving resources tied up until timeouts occur. This matches the scenario of many SYNs to varied ports with no handshake completion.
- ✗
A brute-force password attack against the server
Why it's wrong here
Brute-force password attacks would show completed TCP handshakes followed by authentication attempts at the application layer, not a flood of incomplete SYNs across many ports. The absence of the three-way handshake completion indicates the issue is at the transport layer, not credential guessing. Therefore this activity does not fit the observed pattern of half-open connections.
Visual reference
Go deeper
Related to this question
Key term
Denial-of-service
A Denial-of-service (DoS) attack is an attempt to make a computer, network, or online service unavailable to its intended users by overwhelming it with fake traffic or requests.
Key term
TCP
TCP is a connection-oriented transport layer protocol that ensures reliable, ordered, and error-checked delivery of data between applications over IP networks.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.