Deck 7: Denial-Of-Service Attacks

Question 1

The source of the attack is explicitly identified in the classic ping flood
attack.

Answer 1

True

Question 2

A SIP flood attack exploits the fact that a single INVITE request
triggers considerable resource consumption.

Answer 2

True

Question 3

______ relates to the capacity of the network links connecting a server to the wider Internet.

A)Application resource
B)Network bandwidth
C)System payload
D)Directed broadcast

Answer 3

B

Question 4

The best defense against being an unwitting participant in a DDoS
attack is to prevent your systems from being compromised.

Question 5

The ______ attacks the ability of a network server to respond to TCP connection requests by overflowing the tables used to manage such connections.

A)DNS amplification attack
B)SYN spoofing attack
C)basic flooding attack
D)poison packet attack

Question 6

A ______ triggers a bug in the system's network handling software causing it to crash and the system can no longer communicate over the network until this software is reloaded.

A)echo
B)reflection
C)poison packet
D)flash flood

Question 7

Flooding attacks take a variety of forms based on which network
protocol is being used to implement the attack.

Question 8

There is very little that can be done to prevent a flash crowd.

Question 9

TCP uses the _______ to establish a connection.

A)zombie
B)SYN cookie
C)directed broadcast
D)three-way handshake

Question 10

The attacker needs access to a high-volume network connection for a
SYN spoof attack.

Question 11

A denial-of-service attack is an attempt to compromise availability by
hindering or blocking completely the provision of some service.

Question 12

SYN-ACK and ACK packets are transported using IP,which is an
unreliable network protocol.

Question 13

Given sufficiently privileged access to the network handling code on a
computer system,it is difficult to create packets with a forged source
address.

Question 14

A cyberslam is an application attack that consumes significant
resources,limiting the server's ability to respond to valid requests from
other users.

Question 15

A DoS attack targeting application resources typically aims to overload
or crash its network handling software.

Question 16

Reflector and amplifier attacks use compromised systems running the
attacker's programs.

Question 17

The SYN spoofing attack targets the table of TCP connections on the
server.

Question 18

Slowloris is a form of ICMP flooding.

Question 19

Using forged source addresses is known as _________.

A)source address spoofing
B)a three-way address
C)random dropping
D)directed broadcast

Question 20

DoS attacks cause damage or destruction of IT infrastructures.

Question 21

The standard protocol used for call setup in VoIP is the ________ Protocol.

Question 22

The ICMP echo response packets generated in response to a ping flood using randomly spoofed source addresses is known as _______ traffic.

Question 23

In both direct flooding attacks and ______ the use of spoofed source addresses results in response packets being scattered across the Internet and thus detectable.

A)SYN spoofing attacks
B)indirect flooding attacks
C)ICMP attacks
D)system address spoofing

Question 24

A characteristic of reflection attacks is the lack of _______ traffic.

A)backscatter
B)network
C)three-way
D)botnet

Question 25

______ attacks are a variant of reflector attacks and also involve sending a packet with a spoofed source address for the target system to intermediaries.

Question 26

In a _______ attack the attacker creates a series of DNS requests containing the spoofed source address for the target system.

A)SYN flood
B)DNS amplification
C)poison packet
D)UDP flood

Question 27

During a ______ attack,the attacker sends packets to a known service on the intermediary with a spoofed source address of the actual target system and when the intermediary responds,the response is sent to the target.

Question 28

The four lines of defense against DDoS attacks are: attack prevention and preemption,attack detection and filtering,attack source traceback and identification and _______.

Question 29

_______ bandwidth attacks attempt to take advantage of the disproportionally large resource consumption at a server.

A)Application-based
B)System-based
C)Random
D)Amplification

Question 30

_______ is a text-based protocol with a syntax similar to that of HTTP.

A)RIP
B)DIP
C)SIP
D)HIP

Question 31

_____ attacks flood the network link to the server with a torrent of malicious packets competing with valid traffic flowing to the server.

Question 32

Requests and _______ are the two different types of SIP messages.

Question 33

The best defense against broadcast amplification attacks is to block the use of _______ broadcasts.

Question 34

In reflection attacks,the ______ address directs all the packets at the desired target and any responses to the intermediary.

Question 35

______ attempts to monopolize all of the available request handling threads on the Web server by sending HTTP requests that never complete.

A)HTTP
B)Reflection attacks
C)SYN flooding
D)Slowloris

Question 36

When a DoS attack is detected,the first step is to _______.

A)identify the attack
B)analyze the response
C)design blocking filters
D)shut down the network

Question 37

A _______ flood refers to an attack that bombards Web servers with HTTP requests.

Question 38

Bots starting from a given HTTP link and then following all links on the provided Web site in a recursive way is called _______.

A)trailing
B)spidering
C)spoofing
D)crowding

Question 39

It is possible to specifically defend against the ______ by using a modified version of the TCP connection handling code.

A)three-way handshake
B)UDP flood
C)SYN spoofing attack
D)flash crowd

Question 40

Modifying the system's TCP/IP network code to selectively drop an entry for an incomplete connection from the TCP connections table when it overflows,allowing a new connection attempt to proceed is _______.

A)poison packet
B)slashdot
C)backscatter traffic
D)random drop

Question 41

If an organization is dependent on network services it should consider mirroring and ________ these servers over multiple sites with multiple network connections.

Question 42

A _____ is an action that prevents or impairs the authorized use of networks,systems,or applications by exhausting resources such as central processing units,memory,bandwidth,and disk space.

Question 43

A ______ is a graphical puzzle used to attempt to identify legitimate human initiated interactions.

Question 44

Since filtering needs to be done as close to the source as possible by routers or gateways knowing the valid address ranges of incoming packets,an _______ is best placed to ensure that valid source addresses are used in all packets from its customers.

Question 45

To respond successfully to a DoS attack a good ______ plan is needed that includes details of how to contact technical personal for your ISP(s).