Attacks and Defenses - DoS attack types, detection techniques, classification of attacks - Question Bank

1. What is the main difference between a DoS attack and a DDoS attack in terms of origin?
A) DoS originates from multiple sources, DDoS from a single source.
B) DoS originates from a single source, DDoS from multiple distributed sources.
C) DoS targets applications, DDoS targets network protocols.
D) There is no difference in origin.
2. The classification 'Resource Exhaustion' attacks is most closely related to which other DoS attack type?
A) Packet Spoofing
B) Application Layer Attacks
C) Brute Force Attacks
D) Data Corruption Attacks
3. What is the term for a compromised computer used as part of a botnet for launching DoS/DDoS attacks?
A) Server
B) Client
C) Zombie
D) Honeypot
4. Which of the following is a defense mechanism against application-layer DoS attacks?
A) Increasing the size of UDP packets
B) Implementing CAPTCHAs and rate limiting on specific application functions
C) Blocking all ICMP traffic
D) Using a simple firewall rule to block all traffic
5. What is the primary challenge in identifying the source of a DDoS attack?
A) The attack traffic is too slow
B) The attack originates from numerous distributed and often compromised sources
C) The attack traffic is always encrypted
D) The attack uses only legal network protocols
6. Which of the following is a classification of DoS attacks based on the layer of the OSI model they target?
A) Volumetric, Protocol, Application Layer
B) TCP, UDP, ICMP
C) SYN, ACK, FIN
D) DDoS, Botnet, Zombie
7. A ' Fragmentation attack' is a type of DoS attack that exploits:
A) The way systems reassemble fragmented IP packets
B) The encryption protocols used for data transmission
C) The user authentication mechanisms
D) The database query handling
8. What is the purpose of 'blackholing' traffic during a DoS attack?
A) To redirect all traffic to a secure server
B) To drop all traffic destined for the attacked IP address, effectively making it unavailable but protecting the rest of the network
C) To encrypt all incoming packets
D) To analyze the source of the attack
9. Which of the following is a common symptom of a successful DoS attack on a website?
A) Faster website loading times
B) Increased website uptime
C) Website is inaccessible or extremely slow to load
D) Successful login for all users
10. What is the main advantage of using a Content Delivery Network (CDN) for DoS/DDoS mitigation?
A) It encrypts all user traffic
B) It distributes traffic across multiple servers, absorbing and mitigating large attack volumes
C) It performs deep packet inspection on all incoming traffic
D) It provides anonymous browsing for users
11. Which attack category is characterized by sending malformed packets that exploit vulnerabilities in network protocols like TCP, UDP, or ICMP?
A) Volumetric Attack
B) Application Layer Attack
C) Protocol Attack
D) Data Exfiltration Attack
12. What is the primary goal of a 'Resource Exhaustion' attack?
A) To steal user credentials
B) To gain access to sensitive files
C) To deplete a system's finite resources like CPU, memory, or bandwidth
D) To spread malicious software
13. Which of these is NOT a type of DoS attack?
A) Buffer Overflow
B) SQL Injection
C) SYN Flood
D) Malware Infection
14. What is the classification of an attack that involves sending excessively large packets that may cause buffer overflows on older systems?
A) Application Layer Attack
B) Volumetric Attack
C) Protocol Attack
D) Ping of Death
15. A UDP flood attack aims to overwhelm the target by sending a large volume of UDP packets to:
A) Exhaust the target's CPU by forcing it to process complex requests
B) Consume the target's bandwidth and processing power by forcing it to respond to non-existent connections
C) Exploit vulnerabilities in the UDP protocol itself
D) Perform a man-in-the-middle attack
16. Which of the following is a defense mechanism against SYN flood attacks?
A) Increasing the maximum connection queue size indefinitely
B) Implementing SYN cookies or increasing SYN timeout values
C) Disabling TCP protocol
D) Blocking all ICMP traffic
17. Signature-based detection for DoS attacks relies on:
A) Identifying unusual traffic patterns
B) Comparing incoming traffic against a database of known attack patterns
C) Monitoring the resource utilization of servers
D) Analyzing the source IP addresses of incoming connections
18. What is the main purpose of anomaly detection in DoS attack identification?
A) To match traffic patterns against known attack signatures
B) To identify deviations from normal network behavior that might indicate an attack
C) To block all traffic from specific countries
D) To enforce security policies on end-user devices
19. Which of the following is NOT a typical detection technique for DoS attacks?
A) Anomaly detection
B) Signature-based detection
C) Behavioral analysis
D) Static code analysis of web applications
20. What is the primary goal of a 'zero-day' attack, which can also be used for DoS purposes?
A) Exploiting a vulnerability that is publicly known and patched
B) Exploiting a vulnerability that is unknown to the vendor and for which no patch exists
C) Using a botnet to overwhelm the target
D) Performing a brute-force login attempt
21. An attack that targets the state table of a firewall or load balancer by overwhelming it with connection requests is a type of:
A) Application Layer Attack
B) Volumetric Attack
C) Protocol Attack
D) Resource Exhaustion Attack
22. Which classification of DoS attacks focuses on exploiting flaws in network protocols?
A) Volumetric Attacks
B) Application Layer Attacks
C) Protocol Attacks
D) Data Theft Attacks
23. A 'honeypot' can be used in DoS defense by:
A) Attracting attackers away from real targets and studying their methods
B) Blocking all incoming connections
C) Encrypting all outgoing data
D) Providing a decoy network for legitimate users
24. What is the purpose of traffic scrubbing centers in DoS/DDoS defense?
A) To analyze the source code of web applications
B) To filter out malicious traffic from legitimate traffic before it reaches the target network
C) To store encrypted backups of critical data
D) To perform penetration testing on network infrastructure
25. Which of the following is a proactive defense strategy against DoS attacks?
A) Increasing server RAM after an attack
B) Regularly updating software and patching vulnerabilities
C) Ignoring suspicious traffic patterns
D) Disabling network connectivity during an attack
26. IP address blacklisting is a defense strategy that involves:
A) Allowing traffic only from specific IP ranges
B) Blocking traffic originating from known malicious IP addresses
C) Redirecting suspicious traffic to a honeypot
D) Randomly changing the IP addresses of network devices
27. What is the role of an Intrusion Prevention System (IPS) in defending against DoS attacks?
A) To log all network traffic for later analysis
B) To actively block or drop malicious traffic based on predefined rules or anomaly detection
C) To encrypt sensitive data before it leaves the network
D) To perform regular security audits of the system
28. A Web Application Firewall (WAF) can help mitigate DoS attacks by:
A) Blocking all UDP traffic
B) Filtering malicious HTTP requests and protecting against application-layer attacks
C) Preventing physical access to the server
D) Detecting and removing malware from the network
29. Rate limiting is a defense mechanism that:
A) Encrypts all incoming traffic
B) Restricts the number of requests a server will accept from a single source over a period
C) Blocks all traffic from known malicious IP addresses
D) Automatically scales server resources based on demand
30. Which of the following is a common technique for detecting DoS attacks?
A) Analyzing application logs for syntax errors
B) Monitoring network traffic for unusual spikes in volume or specific packet types
C) Checking for physical tampering with network hardware
D) Scanning for malware on client machines
31. What is the main challenge in detecting DoS/DDoS attacks?
A) The attacks are too simple
B) The attacks originate from a single, easily identifiable source
C) Distinguishing malicious traffic from legitimate high traffic volumes
D) The attacks typically involve no network traffic
32. ICMP flood attacks fall under which category of DoS attacks?
A) Application Layer Attack
B) Volumetric Attack
C) Protocol Attack
D) Data Corruption Attack
33. Which attack targets network infrastructure devices like routers and firewalls by exploiting protocol vulnerabilities?
A) Application Layer Attack
B) Volumetric Attack
C) Protocol Attack
D) Zero-day Attack
34. What is the purpose of sending a large volume of legitimate-looking HTTP requests to a web server during an attack?
A) To test the server's load balancing capabilities
B) To exhaust the server's resources and make it unresponsive
C) To gather information about the server's configuration
D) To perform SQL injection
35. HTTP flood attacks are a type of:
A) Protocol attack
B) Application layer attack
C) Volumetric attack
D) Man-in-the-middle attack
36. Which type of attack involves exploiting vulnerabilities in web applications to disrupt service, such as sending malformed HTTP requests?
A) Volumetric Attack
B) Protocol Attack
C) Application Layer Attack
D) Brute Force Attack
37. What is a 'botnet' in the context of DDoS attacks?
A) A secure network of servers for legitimate traffic
B) A collection of compromised computers controlled remotely by an attacker
C) A type of firewall designed to block DDoS traffic
D) A software tool used for network monitoring
38. Which of the following is a common component of a DDoS attack infrastructure?
A) Firewall
B) Intrusion Detection System
C) Botnet
D) Proxy Server
39. Distributed Denial-of-Service (DDoS) attacks differ from DoS attacks primarily in:
A) The type of traffic generated
B) The number of source machines used to launch the attack
C) The target system's vulnerability
D) The impact on the victim's data integrity
40. What is a 'Slowloris' attack?
A) A volumetric attack that floods the network with UDP packets
B) An application layer attack that keeps connections to the web server open as long as possible
C) A protocol attack that spoofs IP addresses to overwhelm routers
D) A distributed attack originating from multiple compromised machines
41. A 'Ping of Death' attack involves sending a malformed or oversized ICMP packet to a target, which can cause:
A) Increased network latency
B) System instability or crash
C) Temporary network congestion
D) Data corruption in transit
42. Which of the following is a form of amplification attack where an attacker sends a small query with a spoofed source IP address to a large number of servers?
A) Ping of Death
B) Buffer Overflow Attack
C) DNS Amplification Attack
D) SQL Injection
43. What is the goal of a Smurf attack, a type of DoS attack?
A) To deplete the target's CPU resources
B) To exploit a vulnerability in a specific application
C) To amplify traffic by using intermediate broadcast addresses and spoofed source IPs
D) To disable network interface cards
44. In a SYN flood attack, what is the attacker attempting to exploit?
A) The TCP three-way handshake process
B) The UDP connectionless protocol
C) The HTTP request method
D) The DNS resolution process
45. A SYN flood attack primarily targets which layer of the TCP/IP model?
A) Application Layer
B) Transport Layer
C) Network Layer
D) Data Link Layer
46. Which type of DoS attack focuses on consuming the bandwidth of the target network?
A) Application Layer Attack
B) Protocol Attack
C) Volumetric Attack
D) Brute Force Attack
47. A DoS attack that exhausts the target system's processing power by sending a massive number of complex requests is an example of:
A) Packet spoofing
B) Volumetric attack
C) Application layer attack
D) SYN flood
48. Which of the following is a common characteristic of DoS attacks?
A) Exploiting vulnerabilities in application code
B) Overwhelming the target with a flood of traffic or malformed requests
C) Using sophisticated social engineering tactics
D) Deploying ransomware to encrypt files
49. What is the primary objective of a Denial-of-Service (DoS) attack?
A) To steal sensitive data
B) To gain unauthorized access to a system
C) To make a machine or network resource unavailable to its intended users
D) To encrypt all data on a victim's computer
All Question Banks
E-Book Attacks and Defenses - DoS attack types, detection techniques, classification of attacks One Line Questions Attacks and Defenses - DoS attack types, detection techniques, classification of attacks Online Test Attacks and Defenses - DoS attack types, detection techniques, classification of attacks