ITPEC FE Morning October 2018 Question 39

Denial of Service (DoS) — ICMP Flood Attack

An administrator captures network packets and finds hundreds of ICMP packets sent to a host during a non-busy period. This is a classic sign of a DoS attack, specifically an ICMP flood (ping flood).

The correct answer is a) Denial of service.

• •A DoS attack overwhelms a target with excessive traffic (here, ICMP echo requests) to exhaust its resources and make it unavailable for legitimate users.
• •The key clue is the abnormally high volume of ICMP packets during a quiet period — normal traffic would not produce this pattern.

Why not the others:
- b) Man-in-the-middle — involves intercepting communication between two parties; does not generate a flood of packets to a single host.
- c) Spoofing — refers to forging a sender's identity (e.g., IP address). It may be used as part of a DoS attack, but it does not describe the flooding behavior itself.
- d) Worm — a self-replicating malware that spreads across networks. It does not typically manifest as a targeted ICMP flood against a single host.

Key rule: A sudden, unexplained surge of ICMP packets to a host = DoS (ICMP flood). Look for keywords like "hundreds of packets," "not busy time," and "ICMP" as indicators.

AI-generated — may contain errors