SSCP Network and Communications Security Practice Question
A security analyst is investigating a potential attack on a network. The analyst observes a large number of ICMP echo request packets with spoofed source IP addresses being sent to a subnet's broadcast address. Many hosts on the subnet are replying, causing network congestion. Which type of attack is this?
⚠ Common exam trap
The trap here is mixing up Smurf and Fraggle attacks. Smurf uses ICMP, while Fraggle uses UDP. The scenario specifies ICMP, so Smurf is correct.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Smurf attack
The Smurf attack uses ICMP echo requests sent to a broadcast address with a spoofed source IP. All hosts on the subnet reply to the spoofed victim, amplifying traffic and causing a denial of service. The scenario describes exactly this: ICMP echo requests to a broadcast address with spoofed source, causing many replies and congestion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Smurf attack
Why this is correct
A Smurf attack involves sending ICMP echo requests to a broadcast address with a spoofed source IP (the victim's IP). All hosts on the subnet respond to the victim, amplifying the traffic and causing a denial of service. This matches the scenario exactly.
- ✗
Ping of death
Why it's wrong here
Ping of death involves sending an oversized ICMP packet that exceeds the maximum allowed size, causing a target system to crash or malfunction. It does not involve broadcast addresses or amplification. The scenario describes a flood of normal-sized ICMP packets, not a single malformed packet.
- ✗
Fraggle attack
Why it's wrong here
A Fraggle attack is similar to a Smurf attack but uses UDP packets (typically to port 7 or 19) instead of ICMP. The scenario explicitly states ICMP echo requests, making Smurf the correct choice. Fraggle would involve UDP, not ICMP.
- ✗
SYN flood
Why it's wrong here
A SYN flood exploits the TCP three-way handshake by sending many SYN packets with spoofed source addresses, exhausting the target's connection table. The scenario specifically mentions ICMP echo requests, not TCP SYN packets, so this does not apply.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.