Attacks and Defenses - DoS attack types, detection techniques, classification of attacks - One Line Questions

1. What is a 'botnet' in the context of DDoS attacks? — A collection of compromised computers controlled remotely by an attacker
2. What is a 'Slowloris' attack? — An application layer attack that keeps connections to the web server open as long as possible
3. IP address blacklisting is a defense strategy that involves: — Blocking traffic originating from known malicious IP addresses
4. Which of the following is a common technique for detecting DoS attacks? — Monitoring network traffic for unusual spikes in volume or specific packet types
5. Which of the following is NOT a typical detection technique for DoS attacks? — Static code analysis of web applications
6. A SYN flood attack primarily targets which layer of the TCP/IP model? — Transport Layer
7. Which type of DoS attack focuses on consuming the bandwidth of the target network? — Volumetric Attack
8. Which attack targets network infrastructure devices like routers and firewalls by exploiting protocol vulnerabilities? — Protocol Attack
9. ICMP flood attacks fall under which category of DoS attacks? — Protocol Attack
10. An attack that targets the state table of a firewall or load balancer by overwhelming it with connection requests is a type of: — Protocol Attack
11. What is the classification of an attack that involves sending excessively large packets that may cause buffer overflows on older systems? — Ping of Death
12. A 'honeypot' can be used in DoS defense by: — Attracting attackers away from real targets and studying their methods
13. A Web Application Firewall (WAF) can help mitigate DoS attacks by: — Filtering malicious HTTP requests and protecting against application-layer attacks
14. Which of these is NOT a type of DoS attack? — Malware Infection
15. What is the main difference between a DoS attack and a DDoS attack in terms of origin? — DoS originates from a single source, DDoS from multiple distributed sources.
16. Rate limiting is a defense mechanism that: — Restricts the number of requests a server will accept from a single source over a period
17. A UDP flood attack aims to overwhelm the target by sending a large volume of UDP packets to: — Consume the target's bandwidth and processing power by forcing it to respond to non-existent connections
18. What is the primary goal of a 'zero-day' attack, which can also be used for DoS purposes? — Exploiting a vulnerability that is unknown to the vendor and for which no patch exists
19. Which of the following is a common characteristic of DoS attacks? — Overwhelming the target with a flood of traffic or malformed requests
20. Which of the following is a common symptom of a successful DoS attack on a website? — Website is inaccessible or extremely slow to load
21. Which of the following is a common component of a DDoS attack infrastructure? — Botnet
22. Signature-based detection for DoS attacks relies on: — Comparing incoming traffic against a database of known attack patterns
23. A 'Ping of Death' attack involves sending a malformed or oversized ICMP packet to a target, which can cause: — System instability or crash
24. Which of the following is a proactive defense strategy against DoS attacks? — Regularly updating software and patching vulnerabilities
25. Which of the following is a defense mechanism against SYN flood attacks? — Implementing SYN cookies or increasing SYN timeout values
26. Which of the following is a defense mechanism against application-layer DoS attacks? — Implementing CAPTCHAs and rate limiting on specific application functions
27. What is the main advantage of using a Content Delivery Network (CDN) for DoS/DDoS mitigation? — It distributes traffic across multiple servers, absorbing and mitigating large attack volumes
28. A DoS attack that exhausts the target system's processing power by sending a massive number of complex requests is an example of: — Application layer attack
29. The classification 'Resource Exhaustion' attacks is most closely related to which other DoS attack type? — Application Layer Attacks
30. Which of the following is a form of amplification attack where an attacker sends a small query with a spoofed source IP address to a large number of servers? — DNS Amplification Attack
31. HTTP flood attacks are a type of: — Application layer attack
32. What is the term for a compromised computer used as part of a botnet for launching DoS/DDoS attacks? — Zombie
33. What is the primary challenge in identifying the source of a DDoS attack? — The attack originates from numerous distributed and often compromised sources
34. What is the main challenge in detecting DoS/DDoS attacks? — Distinguishing malicious traffic from legitimate high traffic volumes
35. In a SYN flood attack, what is the attacker attempting to exploit? — The TCP three-way handshake process
36. Distributed Denial-of-Service (DDoS) attacks differ from DoS attacks primarily in: — The number of source machines used to launch the attack
37. A ' Fragmentation attack' is a type of DoS attack that exploits: — The way systems reassemble fragmented IP packets
38. What is the purpose of traffic scrubbing centers in DoS/DDoS defense? — To filter out malicious traffic from legitimate traffic before it reaches the target network
39. What is the goal of a Smurf attack, a type of DoS attack? — To amplify traffic by using intermediate broadcast addresses and spoofed source IPs
40. What is the role of an Intrusion Prevention System (IPS) in defending against DoS attacks? — To actively block or drop malicious traffic based on predefined rules or anomaly detection
41. What is the main purpose of anomaly detection in DoS attack identification? — To identify deviations from normal network behavior that might indicate an attack
42. What is the purpose of 'blackholing' traffic during a DoS attack? — To drop all traffic destined for the attacked IP address, effectively making it unavailable but protecting the rest of the network
43. What is the primary objective of a Denial-of-Service (DoS) attack? — To make a machine or network resource unavailable to its intended users
44. What is the primary goal of a 'Resource Exhaustion' attack? — To deplete a system's finite resources like CPU, memory, or bandwidth
45. What is the purpose of sending a large volume of legitimate-looking HTTP requests to a web server during an attack? — To exhaust the server's resources and make it unresponsive
46. Which type of attack involves exploiting vulnerabilities in web applications to disrupt service, such as sending malformed HTTP requests? — Application Layer Attack
47. Which attack category is characterized by sending malformed packets that exploit vulnerabilities in network protocols like TCP, UDP, or ICMP? — Protocol Attack
48. Which classification of DoS attacks focuses on exploiting flaws in network protocols? — Protocol Attacks
49. Which of the following is a classification of DoS attacks based on the layer of the OSI model they target? — Volumetric, Protocol, Application Layer
All One Line Questions
E-Book Attacks and Defenses - DoS attack types, detection techniques, classification of attacks Online Test Attacks and Defenses - DoS attack types, detection techniques, classification of attacks Question Bank Attacks and Defenses - DoS attack types, detection techniques, classification of attacks