SSCP Network and Communications Security Practice Question

Which of the following best describes the function of SYN cookies in mitigating SYN flood attacks?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

They encode connection state in the SYN-ACK sequence number, allowing the server to avoid storing state until the ACK is received.

SYN cookies allow the server to avoid allocating resources for half-open connections until the handshake completes, preventing resource exhaustion.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
They block all incoming SYN packets from suspicious sources.
Why it's wrong here
Blocking is not the mechanism; SYN cookies encode state in the SYN-ACK.
✓
They encode connection state in the SYN-ACK sequence number, allowing the server to avoid storing state until the ACK is received.
Why this is correct
This is the correct description of SYN cookies.
✗
They increase the backlog queue size to accommodate more half-open connections.
Why it's wrong here
Increasing backlog may delay exhaustion but doesn't prevent it.
✗
They require clients to solve a computational puzzle before completing the handshake.
Why it's wrong here
That describes a different mitigation technique, not SYN cookies.

Visual reference

Go deeper