CISSP Communication and Network Security Practice Question
An attacker sends a flood of SYN packets to a server, consuming its resources and preventing legitimate connections. Which OSI layer is this attack targeting?
⚠ Common exam trap
Candidates often confuse the network layer (Layer 3) with the transport layer (Layer 4), because IP addresses are involved in routing the packets, but the attack specifically targets TCP's connection management at Layer 4.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Layer 4
A SYN flood attack targets the TCP three-way handshake at the transport layer (Layer 4). By sending a high volume of SYN packets without completing the handshake, the attacker exhausts the server's connection queue, preventing legitimate TCP connections from being established. This directly exploits the stateful nature of TCP, which is a Layer 4 protocol.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Layer 4
Why this is correct
A SYN flood specifically targets the Transmission Control Protocol (TCP) at the Transport layer (Layer 4) of the OSI model. This attack exploits the TCP three-way handshake by sending numerous SYN (synchronize) requests without completing the final ACK, leaving the server with many half-open connections. This consumes server resources like memory for connection states and CPU cycles, leading to a denial of service for legitimate users attempting to establish new connections.
- ✗
Layer 2
Why it's wrong here
Layer 2, the Data Link layer, deals with physical addressing (MAC addresses) and local network frame transmission within a single network segment. Attacks at this layer, such as ARP spoofing or MAC flooding, manipulate local network traffic or device tables. A SYN flood, however, operates at a higher level, involving the establishment of end-to-end connections across potentially multiple network segments, making it distinct from Layer 2 vulnerabilities.
- ✗
Layer 7
Why it's wrong here
The Application layer (Layer 7) focuses on user-facing services and specific application protocols like HTTP, FTP, or DNS. Attacks at this layer typically involve exploiting vulnerabilities within the application code itself, such as SQL injection, cross-site scripting, or overwhelming specific application functions with legitimate-looking but resource-intensive requests. A SYN flood does not interact with application logic but rather targets the underlying TCP connection establishment mechanism, which precedes application-level communication.
- ✗
Layer 3
Why it's wrong here
Layer 3, the Network layer, is responsible for logical addressing (IP addresses) and routing packets across different networks. Attacks at this layer often involve IP spoofing to hide an attacker's identity, manipulating routing tables, or fragmenting IP packets to bypass security controls. A SYN flood, while utilizing IP packets, specifically targets the stateful connection management of TCP, which is a Transport layer function, rather than the stateless forwarding of IP packets or routing decisions.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.