exam questions

Exam SY0-601 All Questions

View all questions & answers for the SY0-601 exam

Exam SY0-601 topic 1 question 228 discussion

Actual exam question from CompTIA's SY0-601
Question #: 228
Topic #: 1
[All SY0-601 Questions]

A security analyst is reviewing the following output from a system:



Which of the following is MOST likely being observed?

  • A. ARP poisoning
  • B. Man in the middle
  • C. Denial of service
  • D. DNS poisoning
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
ApplebeesWaiter1122
Highly Voted 1 year, 9 months ago
Selected Answer: C
A SYN flood attack, is a type of Denial-of-Service (DoS) attack that exploits the TCP (Transmission Control Protocol) handshake process to overwhelm and exhaust the resources of a target server or network. In a typical TCP handshake, when a client initiates a connection with a server, it sends a SYN (synchronize) packet to the server. The server responds with a SYN-ACK (synchronize-acknowledge) packet, and the client completes the connection establishment by sending an ACK (acknowledge) packet back to the server. Once the handshake is complete, data can be exchanged between the client and server. In a SYN flood attack, the attacker sends a large number of SYN packets to the target server but does not respond to the SYN-ACK packets sent by the server. As a result, the target server keeps waiting for the final ACK packet to complete the connection, and these half-open connections consume server resources such as memory and processing power.
upvoted 22 times
ApplebeesWaiter1122
1 year, 9 months ago
The attacker overwhelms the server with a high volume of half-open connections, causing it to become unresponsive to legitimate client requests. This results in a denial of service, as the server is unable to handle new connections from legitimate users. To mitigate SYN flood attacks, various techniques can be employed, including implementing SYN cookies, rate limiting SYN requests, using firewalls and load balancers, and employing dedicated DDoS protection solutions. These measures help to prevent the exhaustion of server resources and ensure the server can continue to serve legitimate users despite the attack.
upvoted 4 times
...
sujon_london
1 year, 8 months ago
Clear explanation to the point
upvoted 3 times
...
...
jspecht
Highly Voted 2 years, 6 months ago
Selected Answer: C
Once you realize the destination IP and port are on the left the answer is easier to understand. Multiple source ports trying to connect to the same destination IP and port means DOS.
upvoted 10 times
Inimitable
2 years, 4 months ago
I agree with the answer C, but the source IP are on the left and the Destination are on the right. It's a SYN flood attack also known has a half-open attack. The ports of the server are in TIME_WAIT status because someone has started a three-hand-shake connection on each ports and the ports are now waiting for an acknowledge. Unfortunately, the ports will never get this acknowledge, because the attacker want these ports be keeping in waiting status to not be able to respond to any other task.
upvoted 11 times
...
...
[Removed]
Most Recent 2 years, 6 months ago
Selected Answer: C
Dos. One source. one destination. Sending to each port.
upvoted 5 times
...
serginljr
2 years, 6 months ago
Selected Answer: C
C correct
upvoted 3 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago