easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A network security analyst receives an alert from…
A network security analyst receives an alert from the intrusion detection system (IDS) indicating a high volume of TCP SYN packets to a single external IP address from a compromised internal host. This is characteristic of which type of attack?
⚠ Common exam trap
Many candidates confuse a SYN flood (which uses TCP SYN packets to exhaust resources) with a DNS amplification attack (which uses UDP and reflection), but the question's mention of 'TCP SYN packets' directly points to the SYN flood, not a volumetric reflection attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SYN flood
A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target, exhausting its connection table and preventing legitimate connections. The IDS alert specifically describes a compromised internal host generating many SYN packets to a single external IP, which matches the classic behavior of a SYN flood where the attacker spoofs the source IP or uses a bot to saturate the target's resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SYN flood
Why this is correct
A SYN flood is a classic Denial-of-Service (DoS) attack that exploits the TCP three-way handshake. Attackers send a high volume of TCP SYN packets to a target server, but intentionally never complete the handshake by sending the final ACK. This leaves the server with numerous half-open connections, rapidly exhausting its connection table and memory resources, thereby preventing legitimate users from establishing new connections and causing a service outage.
- ✗
Man-in-the-middle
Why it's wrong here
A Man-in-the-Middle (MITM) attack involves an adversary secretly relaying and potentially altering the communication between two parties who believe they are directly communicating with each other. This attack focuses on intercepting and manipulating data flow, often for eavesdropping, data modification, or credential theft, rather than overwhelming a system with a high volume of packets. Therefore, an alert indicating a 'flood' of packets would not typically point to a MITM scenario, which relies on stealth and position.
- ✗
ARP spoofing
Why it's wrong here
ARP spoofing, also known as ARP poisoning, is a technique where an attacker sends forged Address Resolution Protocol (ARP) messages over a local area network. The goal is to associate the attacker's MAC address with the IP address of another host, such as a default gateway, causing traffic intended for that host to be redirected through the attacker's machine. This attack primarily facilitates local traffic interception or MITM scenarios within a network segment, rather than generating a high volume of SYN packets to flood a target server.
- ✗
DNS amplification
Why it's wrong here
DNS amplification is a type of Distributed Denial-of-Service (DDoS) attack that leverages open DNS resolvers to magnify the volume of attack traffic directed at a victim. Attackers send small DNS queries with a spoofed source IP address (the victim's) to numerous vulnerable DNS servers, which then respond with much larger replies directed at the victim. This attack primarily uses UDP for DNS queries and responses, making it distinct from a TCP SYN flood which specifically targets the TCP handshake mechanism with SYN packets.
Visual reference
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Network security
Network security is the practice of protecting a computer network from unauthorized access, misuse, malfunction, modification, destruction, or improper disclosure, ensuring the confidentiality, integrity, and availability of data and resources.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.