Ethical Hacking Essentials Practice Test

Which attack attempts to consume network resources by creating incomplete TCP connections?

1. Fragmentation Attack

2. SYN Flood Attack

3. Permanent DoS Attack

4. UDP Flood Attack

The correct answer is: SYN Flood Attack

The SYN Flood Attack is designed to consume network resources through the manipulation of TCP connection establishment. In the TCP protocol, a connection is initiated through a three-way handshake, which consists of a SYN (synchronize) message, a SYN-ACK (synchronize acknowledgment) response, and an ACK (acknowledgment) message. In a SYN Flood Attack, an attacker sends a large volume of SYN requests to a target server, often using spoofed IP addresses so that the return SYN-ACK responses are sent to unsuspecting or non-existent hosts. The server, receiving these SYN requests, allocates resources to handle each session and sends out the corresponding SYN-ACK responses. However, because the acknowledgments (ACKs) never reach the server (due to the spoofing or the flood of requests), the connections remain incomplete. As the server continues to hold resources for these half-open connections, it can become overwhelmed, leading to a denial of service as legitimate users are unable to establish new connections. This makes the SYN Flood a significant threat in the realm of network security, focusing specifically on exploiting how TCP connections are established to cause resource exhaustion. Other attacks mentioned, such as Fragmentation Attacks, Permanent DoS Attacks, and