SSCP Network and Communications Security Practice Question
A security administrator is reviewing network traffic logs and notices a large number of TCP SYN packets from various source IP addresses to a single destination IP address on port 443. The destination server is unresponsive. Which type of attack is most likely occurring?
⚠ Common exam trap
Watch out — candidates often confuse a SYN flood with other volumetric attacks that also cause unresponsiveness but use different protocols, such as ICMP-based floods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SYN flood
The scenario describes a large volume of TCP SYN packets from various sources to a single destination, resulting in an unresponsive server. This is indicative of a SYN flood attack, where the attacker sends numerous SYN requests but does not complete the TCP handshake, causing the server to exhaust its resources on half-open connections. Other attacks like Smurf, ping flood, or Teardrop involve different protocols or mechanisms and do not match the described traffic pattern.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Teardrop attack
Why it's wrong here
A Teardrop attack involves sending fragmented packets with overlapping fragment offsets, causing the target to crash when reassembling them. The scenario does not mention fragmented packets; it involves TCP SYN packets. Teardrop attacks exploit vulnerabilities in fragment reassembly, not TCP handshake mechanisms. Therefore, this is not the correct answer.
- ✓
SYN flood
Why this is correct
A SYN flood is a type of denial-of-service attack where an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive. The server allocates resources for each half-open connection, and when the attacker never completes the handshake, those resources are exhausted. The scenario describes many SYN packets from spoofed sources to one destination, which is characteristic of a SYN flood.
- ✗
Ping flood
Why it's wrong here
A ping flood is a denial-of-service attack that overwhelms the target with ICMP echo requests. The scenario describes TCP SYN packets, not ICMP echo requests. Ping floods do not typically cause a server to become unresponsive due to half-open connections; they consume bandwidth. Thus, this is not the correct attack type.
- ✗
Smurf attack
Why it's wrong here
A Smurf attack involves sending ICMP echo requests to a broadcast address with a spoofed source IP, causing many hosts to reply to the victim. The scenario involves TCP SYN packets to port 443, not ICMP traffic. Smurf attacks amplify traffic using ICMP, whereas this attack uses TCP SYN packets directly to the target. Therefore, it is not a Smurf attack.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.