Deck 7: Denial-Of-Service Attacks

Question 1

TCP uses the _______ to establish a connection.

A) zombie
B) SYN cookie
C) directed broadcast
D) three-way handshake

Answer 1

D

Question 2

DoS attacks cause damage or destruction of IT infrastructures.

Answer 2

False

Question 3

Slowloris is a form of ICMP flooding.

Answer 3

False

Question 4

Flooding attacks take a variety of forms based on which networkprotocol is being used to implement the attack.

Question 5

There is very little that can be done to prevent a flash crowd.

Question 6

A denial-of-service attack is an attempt to compromise availability byhindering or blocking completely the provision of some service.

Question 7

A ______ triggers a bug in the system's network handling software causing it to crash and the system can no longer communicate over the network until this software is reloaded.

A) echo
B) reflection
C) poison packet
D) flash flood

Question 8

Using forged source addresses is known as _________.

A) source address spoofing
B) a three-way address
C) random dropping
D) directed broadcast

Question 9

A SIP flood attack exploits the fact that a single INVITE requesttriggers considerable resource consumption.

Question 10

Reflector and amplifier attacks use compromised systems running theattacker's programs.

Question 11

The ______ attacks the ability of a network server to respond to TCP connection requests by overflowing the tables used to manage such connections.

A) DNS amplification attack
B) SYN spoofing attack
C) basic flooding attack
D) poison packet attack

Question 12

______ relates to the capacity of the network links connecting a server to the wider Internet.

A) Application resource
B) Network bandwidth
C) System payload
D) Directed broadcast

Question 13

The SYN spoofing attack targets the table of TCP connections on theserver.

Question 14

Given sufficiently privileged access to the network handling code on acomputer system, it is difficult to create packets with a forged sourceaddress.

Question 15

The best defense against being an unwitting participant in a DDoSattack is to prevent your systems from being compromised.

Question 16

A DoS attack targeting application resources typically aims to overloador crash its network handling software.

Question 17

The source of the attack is explicitly identified in the classic ping floodattack.

Question 18

The attacker needs access to a high-volume network connection for aSYN spoof attack.

Question 19

SYN-ACK and ACK packets are transported using IP, which is anunreliable network protocol.

Question 20

A cyberslam is an application attack that consumes significantresources, limiting the server's ability to respond to valid requests fromother users.

Question 21

_______ bandwidth attacks attempt to take advantage of the disproportionally large resource consumption at a server.

A) Application-based
B) System-based
C) Random
D) Amplification

Question 22

_____ attacks flood the network link to the server with a torrent of malicious packets competing with valid traffic flowing to the server.

Question 23

The four lines of defense against DDoS attacks are: attack prevention and preemption, attack detection and filtering, attack source traceback and identification and _______.

Question 24

_______ is a text-based protocol with a syntax similar to that of HTTP.

A) RIP
B) DIP
C) SIP
D) HIP

Question 25

In reflection attacks, the ______ address directs all the packets at the desired target and any responses to the intermediary.

Question 26

It is possible to specifically defend against the ______ by using a modified version of the TCP connection handling code.

A) three-way handshake
B) UDP flood
C) SYN spoofing attack
D) flash crowd

Question 27

______ attacks are a variant of reflector attacks and also involve sending a packet with a spoofed source address for the target system to intermediaries.

Question 28

Modifying the system's TCP/IP network code to selectively drop an entry for an incomplete connection from the TCP connections table when it overflows, allowing a new connection attempt to proceed is _______.

A) poison packet
B) slashdot
C) backscatter traffic
D) random drop

Question 29

In both direct flooding attacks and ______ the use of spoofed source addresses results in response packets being scattered across the Internet and thus detectable.

A) SYN spoofing attacks
B) indirect flooding attacks
C) ICMP attacks
D) system address spoofing

Question 30

A _______ flood refers to an attack that bombards Web servers with HTTP requests.

Question 31

In a _______ attack the attacker creates a series of DNS requests containing the spoofed source address for the target system.

A) SYN flood
B) DNS amplification
C) poison packet
D) UDP flood

Question 32

The ICMP echo response packets generated in response to a ping flood using randomly spoofed source addresses is known as _______ traffic.

Question 33

When a DoS attack is detected, the first step is to _______.

A) identify the attack
B) analyze the response
C) design blocking filters
D) shut down the network

Question 34

______ attempts to monopolize all of the available request handling threads on the Web server by sending HTTP requests that never complete.

A) HTTP
B) Reflection attacks
C) SYN flooding
D) Slowloris

Question 35

The best defense against broadcast amplification attacks is to block the use of _______ broadcasts.

Question 36

The standard protocol used for call setup in VoIP is the ________ Protocol.

Question 37

Requests and _______ are the two different types of SIP messages.

Question 38

Bots starting from a given HTTP link and then following all links on the provided Web site in a recursive way is called _______.

A) trailing
B) spidering
C) spoofing
D) crowding

Question 39

A characteristic of reflection attacks is the lack of _______ traffic.

A) backscatter
B) network
C) three-way
D) botnet

Question 40

During a ______ attack, the attacker sends packets to a known service on the intermediary with a spoofed source address of the actual target system and when the intermediary responds, the response is sent to the target.

Question 41

To respond successfully to a DoS attack a good ______ plan is needed that includes details of how to contact technical personal for your ISP(s).

Question 42

A ______ is a graphical puzzle used to attempt to identify legitimate human initiated interactions.

Question 43

If an organization is dependent on network services it should consider mirroring and ________ these servers over multiple sites with multiple network connections.

Question 44

Since filtering needs to be done as close to the source as possible by routers or gateways knowing the valid address ranges of incoming packets, an _______ is best placed to ensure that valid source addresses are used in all packets from its customers.

Question 45

A _____ is an action that prevents or impairs the authorized use of networks, systems, or applications by exhausting resources such as central processing units, memory, bandwidth, and disk space.