SSCP Network and Communications Security Practice Question
A system administrator notices a high number of half-open TCP connections to the company's web server. The server is becoming unresponsive. Which attack is likely occurring, and which mitigation is effective?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SYN flood; mitigation: enable SYN cookies.
A SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing the handshake. SYN cookies allow the server to avoid allocating resources until the handshake completes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ARP spoofing; mitigation: static ARP entries.
Why it's wrong here
ARP spoofing targets the ARP table, not TCP connections.
- ✗
Smurf attack; mitigation: disable IP broadcasts.
Why it's wrong here
Smurf uses ICMP broadcast amplification, not TCP half-open connections.
- ✓
SYN flood; mitigation: enable SYN cookies.
Why this is correct
SYN cookies allow the server to maintain state without allocating resources until the handshake completes.
- ✗
Ping of death; mitigation: block fragmented ICMP packets.
Why it's wrong here
Ping of death uses oversized ICMP packets, not TCP.
Visual reference
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are methods to defend against SYN flood attacks? (Select TWO)
medium- A.Enabling IP routing
- B.Using UDP instead of TCP
- ✓ C.Increasing the SYN backlog queue size
- ✓ D.SYN cookies
- E.Disabling TCP timestamps
Why C: SYN cookies avoid resource exhaustion by not allocating memory until the handshake completes, and increasing the backlog queue allows more half-open connections before reaching capacity.
Variation 2. A security analyst is reviewing firewall logs and notices a high rate of TCP SYN packets to multiple ports on a server, but no corresponding ACK or RST packets. This is characteristic of which type of attack?
hard- A.UDP flood
- ✓ B.SYN flood
- C.Smurf attack
- D.Ping of death
Why B: SYN flood sends many SYN packets without completing the handshake, exhausting server resources.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.