Information Technology Specialist (ITS) Cybersecurity Practice Exam

What is a SYN flood attack designed to do?

1. Force a server to use more bandwidth

2. Prevent a server from completing half-open connections

3. Steal information from user sessions

4. Redirect network traffic to a malicious site

The correct answer is: Prevent a server from completing half-open connections

A SYN flood attack is a type of denial-of-service attack specifically targeting the TCP handshake process. When a client wants to establish a connection with a server, it sends a SYN (synchronize) packet. The server then responds with a SYN-ACK (synchronize acknowledgment) packet, and finally, the client sends an ACK (acknowledgment) packet to complete the connection. In a SYN flood attack, an attacker sends a large number of SYN packets to a server while spoofing the source IP addresses. The server replies with SYN-ACK packets but receives no response because the source IP addresses are not legitimate. As a result, the server's resources are consumed in waiting for the ACK packets that never arrive. This causes the server to become overwhelmed with half-open connections, significantly degrading its ability to handle legitimate traffic. By focusing on the nature of the attack, it becomes clear that the goal of a SYN flood attack is to prevent the server from completing the half-open connections by exhausting its resources, rendering it unable to respond to legitimate connection requests.