Deck 7: Denial-Of-Service Attacks

Question 1

A denial-of-service attack is an attempt to compromise availability by
hindering or blocking completely the provision of some service.

Answer 1

True

Question 2

Using forged source addresses is known as _________.

A)source address spoofing
B)a three-way address
C)random dropping
D)directed broadcast

Answer 2

A

Question 3

Flooding attacks take a variety of forms based on which network
protocol is being used to implement the attack.

Answer 3

True

Question 4

The SYN spoofing attack targets the table of TCP connections on the
server.

Question 5

The best defense against being an unwitting participant in a DDoS
attack is to prevent your systems from being compromised.

Question 6

A SIP flood attack exploits the fact that a single INVITE request
triggers considerable resource consumption.

Question 7

Given sufficiently privileged access to the network handling code on a
computer system,it is difficult to create packets with a forged source
address.

Question 8

DoS attacks cause damage or destruction of IT infrastructures.

Question 9

Reflector and amplifier attacks use compromised systems running the
attacker's programs.

Question 10

A ______ triggers a bug in the system's network handling software causing it to crash and the system can no longer communicate over the network until this software is reloaded.

A)echo
B)reflection
C)poison packet
D)flash flood

Question 11

There is very little that can be done to prevent a flash crowd.

Question 12

______ relates to the capacity of the network links connecting a server to the wider Internet.

A)Application resource
B)Network bandwidth
C)System payload
D)Directed broadcast

Question 13

SYN-ACK and ACK packets are transported using IP,which is an
unreliable network protocol.

Question 14

A cyberslam is an application attack that consumes significant
resources,limiting the server's ability to respond to valid requests from
other users.

Question 15

Slowloris is a form of ICMP flooding.

Question 16

TCP uses the _______ to establish a connection.

A)zombie
B)SYN cookie
C)directed broadcast
D)three-way handshake

Question 17

A DoS attack targeting application resources typically aims to overload
or crash its network handling software.

Question 18

The source of the attack is explicitly identified in the classic ping flood
attack.

Question 19

The attacker needs access to a high-volume network connection for a
SYN spoof attack.

Question 20

The ______ attacks the ability of a network server to respond to TCP connection requests by overflowing the tables used to manage such connections.

A)DNS amplification attack
B)SYN spoofing attack
C)basic flooding attack
D)poison packet attack

Question 21

It is possible to specifically defend against the ______ by using a modified version of the TCP connection handling code.

A)three-way handshake
B)UDP flood
C)SYN spoofing attack
D)flash crowd

Question 22

The best defense against broadcast amplification attacks is to block the use of _______ broadcasts.

Question 23

When a DoS attack is detected,the first step is to _______.

A)identify the attack
B)analyze the response
C)design blocking filters
D)shut down the network

Question 24

The standard protocol used for call setup in VoIP is the ________ Protocol.

Question 25

_____ attacks flood the network link to the server with a torrent of malicious packets competing with valid traffic flowing to the server.

Question 26

______ attacks are a variant of reflector attacks and also involve sending a packet with a spoofed source address for the target system to intermediaries.

Question 27

Requests and _______ are the two different types of SIP messages.

Question 28

Modifying the system's TCP/IP network code to selectively drop an entry for an incomplete connection from the TCP connections table when it overflows,allowing a new connection attempt to proceed is _______.

A)poison packet
B)slashdot
C)backscatter traffic
D)random drop

Question 29

Bots starting from a given HTTP link and then following all links on the provided Web site in a recursive way is called _______.

A)trailing
B)spidering
C)spoofing
D)crowding

Question 30

In a _______ attack the attacker creates a series of DNS requests containing the spoofed source address for the target system.

A)SYN flood
B)DNS amplification
C)poison packet
D)UDP flood

Question 31

In both direct flooding attacks and ______ the use of spoofed source addresses results in response packets being scattered across the Internet and thus detectable.

A)SYN spoofing attacks
B)indirect flooding attacks
C)ICMP attacks
D)system address spoofing

Question 32

A characteristic of reflection attacks is the lack of _______ traffic.

A)backscatter
B)network
C)three-way
D)botnet

Question 33

During a ______ attack,the attacker sends packets to a known service on the intermediary with a spoofed source address of the actual target system and when the intermediary responds,the response is sent to the target.

Question 34

______ attempts to monopolize all of the available request handling threads on the Web server by sending HTTP requests that never complete.

A)HTTP
B)Reflection attacks
C)SYN flooding
D)Slowloris

Question 35

_______ is a text-based protocol with a syntax similar to that of HTTP.

A)RIP
B)DIP
C)SIP
D)HIP

Question 36

The four lines of defense against DDoS attacks are: attack prevention and preemption,attack detection and filtering,attack source traceback and identification and _______.

Question 37

In reflection attacks,the ______ address directs all the packets at the desired target and any responses to the intermediary.

Question 38

The ICMP echo response packets generated in response to a ping flood using randomly spoofed source addresses is known as _______ traffic.

Question 39

A _______ flood refers to an attack that bombards Web servers with HTTP requests.

Question 40

_______ bandwidth attacks attempt to take advantage of the disproportionally large resource consumption at a server.

A)Application-based
B)System-based
C)Random
D)Amplification

Question 41

A _____ is an action that prevents or impairs the authorized use of networks,systems,or applications by exhausting resources such as central processing units,memory,bandwidth,and disk space.

Question 42

To respond successfully to a DoS attack a good ______ plan is needed that includes details of how to contact technical personal for your ISP(s).

Question 43

Since filtering needs to be done as close to the source as possible by routers or gateways knowing the valid address ranges of incoming packets,an _______ is best placed to ensure that valid source addresses are used in all packets from its customers.

Question 44

If an organization is dependent on network services it should consider mirroring and ________ these servers over multiple sites with multiple network connections.

Question 45

A ______ is a graphical puzzle used to attempt to identify legitimate human initiated interactions.