ITPEC FE Morning October 2018 Question 39
An administrator captures network packets and discovers that hundreds of ICMP packets have been sent to the host. However, it is not a particularly busy time of the day. Which of the following is the most likely the attack executed against the computer in this situation?
Explanation
Denial of service — hundreds of ICMP packets at a quiet time point to a ping flood meant to exhaust the host.
ICMP carries echo requests (ping) and error messages, and normal traffic produces only a few. A burst of hundreds aimed at one host, when users are not busy, is not legitimate load: the host has to answer every packet, which uses up its bandwidth and processing and can make it unavailable to real users. That is a denial of service (DoS) attack.
Answer (a)
Why not others:
- •(b) Man-in-the-middle — the attacker quietly sits between two parties to read or alter their traffic; it does not flood a host
- •(c) Spoofing — forging a sender's identity; a flood may use spoofed addresses, but the attack described is the flood itself
- •(d) Worm — self-replicating malware spreading to other computers, which shows as infection and scanning, not a stream of ICMP at one host
Key rule: An abnormal volume of traffic aimed at one host is the signature of denial of service; judge the attack by its effect, not by the tricks it may use.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.