Q7Network Intrusion Analysis
After a substantial influx of network traffic to externally facing devices, a security engineer investigates what appears to be a denial-of-service attack. On reviewing the packet-capture data, the engineer observes that the traffic consists of one SYN packet to each port. Which type of attack is taking place?
← → navigate · a answer
Community votes
Discussion · 3
B 2
Selected Answer: B
A single SYN packet sent to each port is indicative of port scanning. Answer B.
B 2
Selected Answer: B
The correct answer is:
B. port scanning
Explanation:
A port scanning attack is marked by sending packets (often a single SYN packet) to multiple ports on a target machine to find which ports are open, closed, or filtered. This matches the scenario described, where a single SYN packet is sent to each port.
Why not D. SYN flood
A SYN flood attack involves sending many SYN packets to a specific port to overwhelm the target, which is different from the described behavior of hitting multiple ports with single packets.
B 1
Selected Answer: B
ChatGPT is with us on this one! B