TRB PG Assistant - Attacks and Defenses - DoS attack types, detection techniques, classification of attacks Online Test (MCQ Quiz)

1. What is the primary objective of a Denial-of-Service (DoS) attack?

A) To steal sensitive data B) To gain unauthorized access to a system C) To make a machine or network resource unavailable to its intended users D) To encrypt all data on a victim's computer

2. Which of the following is a common characteristic of DoS attacks?

A) Exploiting vulnerabilities in application code B) Overwhelming the target with a flood of traffic or malformed requests C) Using sophisticated social engineering tactics D) Deploying ransomware to encrypt files

3. A DoS attack that exhausts the target system's processing power by sending a massive number of complex requests is an example of:

A) Packet spoofing B) Volumetric attack C) Application layer attack D) SYN flood

4. Which type of DoS attack focuses on consuming the bandwidth of the target network?

A) Application Layer Attack B) Protocol Attack C) Volumetric Attack D) Brute Force Attack

5. A SYN flood attack primarily targets which layer of the TCP/IP model?

A) Application Layer B) Transport Layer C) Network Layer D) Data Link Layer

6. In a SYN flood attack, what is the attacker attempting to exploit?

A) The TCP three-way handshake process B) The UDP connectionless protocol C) The HTTP request method D) The DNS resolution process

7. What is the goal of a Smurf attack, a type of DoS attack?

A) To deplete the target's CPU resources B) To exploit a vulnerability in a specific application C) To amplify traffic by using intermediate broadcast addresses and spoofed source IPs D) To disable network interface cards

8. Which of the following is a form of amplification attack where an attacker sends a small query with a spoofed source IP address to a large number of servers?

A) Ping of Death B) Buffer Overflow Attack C) DNS Amplification Attack D) SQL Injection

9. A 'Ping of Death' attack involves sending a malformed or oversized ICMP packet to a target, which can cause:

A) Increased network latency B) System instability or crash C) Temporary network congestion D) Data corruption in transit

10. What is a 'Slowloris' attack?

A) A volumetric attack that floods the network with UDP packets B) An application layer attack that keeps connections to the web server open as long as possible C) A protocol attack that spoofs IP addresses to overwhelm routers D) A distributed attack originating from multiple compromised machines

11. Distributed Denial-of-Service (DDoS) attacks differ from DoS attacks primarily in:

A) The type of traffic generated B) The number of source machines used to launch the attack C) The target system's vulnerability D) The impact on the victim's data integrity

12. Which of the following is a common component of a DDoS attack infrastructure?

A) Firewall B) Intrusion Detection System C) Botnet D) Proxy Server

13. What is a 'botnet' in the context of DDoS attacks?

A) A secure network of servers for legitimate traffic B) A collection of compromised computers controlled remotely by an attacker C) A type of firewall designed to block DDoS traffic D) A software tool used for network monitoring

14. Which type of attack involves exploiting vulnerabilities in web applications to disrupt service, such as sending malformed HTTP requests?

A) Volumetric Attack B) Protocol Attack C) Application Layer Attack D) Brute Force Attack

15. HTTP flood attacks are a type of:

A) Protocol attack B) Application layer attack C) Volumetric attack D) Man-in-the-middle attack

16. What is the purpose of sending a large volume of legitimate-looking HTTP requests to a web server during an attack?

A) To test the server's load balancing capabilities B) To exhaust the server's resources and make it unresponsive C) To gather information about the server's configuration D) To perform SQL injection

17. Which attack targets network infrastructure devices like routers and firewalls by exploiting protocol vulnerabilities?

A) Application Layer Attack B) Volumetric Attack C) Protocol Attack D) Zero-day Attack

18. ICMP flood attacks fall under which category of DoS attacks?

A) Application Layer Attack B) Volumetric Attack C) Protocol Attack D) Data Corruption Attack

19. What is the main challenge in detecting DoS/DDoS attacks?

A) The attacks are too simple B) The attacks originate from a single, easily identifiable source C) Distinguishing malicious traffic from legitimate high traffic volumes D) The attacks typically involve no network traffic

20. Which of the following is a common technique for detecting DoS attacks?

A) Analyzing application logs for syntax errors B) Monitoring network traffic for unusual spikes in volume or specific packet types C) Checking for physical tampering with network hardware D) Scanning for malware on client machines

21. Rate limiting is a defense mechanism that:

A) Encrypts all incoming traffic B) Restricts the number of requests a server will accept from a single source over a period C) Blocks all traffic from known malicious IP addresses D) Automatically scales server resources based on demand

22. A Web Application Firewall (WAF) can help mitigate DoS attacks by:

A) Blocking all UDP traffic B) Filtering malicious HTTP requests and protecting against application-layer attacks C) Preventing physical access to the server D) Detecting and removing malware from the network

23. What is the role of an Intrusion Prevention System (IPS) in defending against DoS attacks?

A) To log all network traffic for later analysis B) To actively block or drop malicious traffic based on predefined rules or anomaly detection C) To encrypt sensitive data before it leaves the network D) To perform regular security audits of the system

24. IP address blacklisting is a defense strategy that involves:

A) Allowing traffic only from specific IP ranges B) Blocking traffic originating from known malicious IP addresses C) Redirecting suspicious traffic to a honeypot D) Randomly changing the IP addresses of network devices

25. Which of the following is a proactive defense strategy against DoS attacks?

A) Increasing server RAM after an attack B) Regularly updating software and patching vulnerabilities C) Ignoring suspicious traffic patterns D) Disabling network connectivity during an attack

26. What is the purpose of traffic scrubbing centers in DoS/DDoS defense?

A) To analyze the source code of web applications B) To filter out malicious traffic from legitimate traffic before it reaches the target network C) To store encrypted backups of critical data D) To perform penetration testing on network infrastructure

27. A 'honeypot' can be used in DoS defense by:

A) Attracting attackers away from real targets and studying their methods B) Blocking all incoming connections C) Encrypting all outgoing data D) Providing a decoy network for legitimate users

28. Which classification of DoS attacks focuses on exploiting flaws in network protocols?

A) Volumetric Attacks B) Application Layer Attacks C) Protocol Attacks D) Data Theft Attacks

29. An attack that targets the state table of a firewall or load balancer by overwhelming it with connection requests is a type of:

A) Application Layer Attack B) Volumetric Attack C) Protocol Attack D) Resource Exhaustion Attack

30. What is the primary goal of a 'zero-day' attack, which can also be used for DoS purposes?

A) Exploiting a vulnerability that is publicly known and patched B) Exploiting a vulnerability that is unknown to the vendor and for which no patch exists C) Using a botnet to overwhelm the target D) Performing a brute-force login attempt

31. Which of the following is NOT a typical detection technique for DoS attacks?

A) Anomaly detection B) Signature-based detection C) Behavioral analysis D) Static code analysis of web applications

32. What is the main purpose of anomaly detection in DoS attack identification?

A) To match traffic patterns against known attack signatures B) To identify deviations from normal network behavior that might indicate an attack C) To block all traffic from specific countries D) To enforce security policies on end-user devices

33. Signature-based detection for DoS attacks relies on:

A) Identifying unusual traffic patterns B) Comparing incoming traffic against a database of known attack patterns C) Monitoring the resource utilization of servers D) Analyzing the source IP addresses of incoming connections

34. Which of the following is a defense mechanism against SYN flood attacks?

A) Increasing the maximum connection queue size indefinitely B) Implementing SYN cookies or increasing SYN timeout values C) Disabling TCP protocol D) Blocking all ICMP traffic

35. A UDP flood attack aims to overwhelm the target by sending a large volume of UDP packets to:

A) Exhaust the target's CPU by forcing it to process complex requests B) Consume the target's bandwidth and processing power by forcing it to respond to non-existent connections C) Exploit vulnerabilities in the UDP protocol itself D) Perform a man-in-the-middle attack

36. What is the classification of an attack that involves sending excessively large packets that may cause buffer overflows on older systems?

A) Application Layer Attack B) Volumetric Attack C) Protocol Attack D) Ping of Death

37. Which of these is NOT a type of DoS attack?

A) Buffer Overflow B) SQL Injection C) SYN Flood D) Malware Infection

38. What is the primary goal of a 'Resource Exhaustion' attack?

A) To steal user credentials B) To gain access to sensitive files C) To deplete a system's finite resources like CPU, memory, or bandwidth D) To spread malicious software

39. Which attack category is characterized by sending malformed packets that exploit vulnerabilities in network protocols like TCP, UDP, or ICMP?

A) Volumetric Attack B) Application Layer Attack C) Protocol Attack D) Data Exfiltration Attack

40. What is the main advantage of using a Content Delivery Network (CDN) for DoS/DDoS mitigation?

A) It encrypts all user traffic B) It distributes traffic across multiple servers, absorbing and mitigating large attack volumes C) It performs deep packet inspection on all incoming traffic D) It provides anonymous browsing for users

41. Which of the following is a common symptom of a successful DoS attack on a website?

A) Faster website loading times B) Increased website uptime C) Website is inaccessible or extremely slow to load D) Successful login for all users

42. What is the purpose of 'blackholing' traffic during a DoS attack?

A) To redirect all traffic to a secure server B) To drop all traffic destined for the attacked IP address, effectively making it unavailable but protecting the rest of the network C) To encrypt all incoming packets D) To analyze the source of the attack

43. A ' Fragmentation attack' is a type of DoS attack that exploits:

A) The way systems reassemble fragmented IP packets B) The encryption protocols used for data transmission C) The user authentication mechanisms D) The database query handling

44. Which of the following is a classification of DoS attacks based on the layer of the OSI model they target?

A) Volumetric, Protocol, Application Layer B) TCP, UDP, ICMP C) SYN, ACK, FIN D) DDoS, Botnet, Zombie

45. What is the primary challenge in identifying the source of a DDoS attack?

A) The attack traffic is too slow B) The attack originates from numerous distributed and often compromised sources C) The attack traffic is always encrypted D) The attack uses only legal network protocols

46. Which of the following is a defense mechanism against application-layer DoS attacks?

A) Increasing the size of UDP packets B) Implementing CAPTCHAs and rate limiting on specific application functions C) Blocking all ICMP traffic D) Using a simple firewall rule to block all traffic

47. What is the term for a compromised computer used as part of a botnet for launching DoS/DDoS attacks?

A) Server B) Client C) Zombie D) Honeypot

48. The classification 'Resource Exhaustion' attacks is most closely related to which other DoS attack type?

A) Packet Spoofing B) Application Layer Attacks C) Brute Force Attacks D) Data Corruption Attacks

49. What is the main difference between a DoS attack and a DDoS attack in terms of origin?

A) DoS originates from multiple sources, DDoS from a single source. B) DoS originates from a single source, DDoS from multiple distributed sources. C) DoS targets applications, DDoS targets network protocols. D) There is no difference in origin.

Attacks and Defenses - DoS attack types, detection techniques, classification of attacks - Online Test

Test Results