SSCP Network and Communications Security Practice Question
Which attack sends a flood of forged ICMP echo requests to a network's broadcast address to overwhelm a target?
⚠ Common exam trap
SSCP often tests the distinction between various flood attacks, and candidates might confuse Smurf with SYN flood or DNS amplification due to the common element of flooding.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Smurf attack
A Smurf attack sends a flood of forged ICMP echo requests to a network's broadcast address with the source IP spoofed as the target's IP. All hosts on the network respond to the broadcast, overwhelming the target with ICMP echo replies. This is a classic amplification attack. Therefore, Smurf attack is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ping of death
Why it's wrong here
Ping of death overwhelms a target with a single oversized or fragmented ICMP packet that crashes it, not a flood of echo requests to a broadcast address. It is tempting because it also abuses ICMP echo, so it would be correct if the stem described malformed oversized packets rather than broadcast flooding.
- ✓
Smurf attack
Why this is correct
A Smurf attack spoofs the victim's source address and sends ICMP echo requests to a network broadcast address, so every host replies to the victim, amplifying traffic. This matches the stem's forged ICMP flood against a broadcast address.
- ✗
SYN flood
Why it's wrong here
A SYN flood exhausts TCP connection state by sending forged TCP SYN packets, never ICMP echo requests to a broadcast address. It is tempting because both are volumetric denial-of-service floods, so SYN flood would be correct if the stem described half-open TCP connections rather than ICMP broadcast traffic.
- ✗
DNS amplification
Why it's wrong here
DNS amplification floods a victim using spoofed DNS queries and large responses, not ICMP echo requests to a broadcast address. It is tempting because both are reflection-amplification attacks, so DNS amplification would be correct if the stem described spoofed queries to open resolvers instead of ICMP broadcast traffic.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.