Eccouncil 312-50 Exam - Topic 16 Question 102 Discussion

Actual exam question for Eccouncil's 312-50 exam

Question #: 102
Topic #: 16

Your network infrastructure is under a SYN flood attack. The attacker has crafted an automated botnet to

simultaneously send 's' SYN packets per second to the server. You have put measures in place to manage 'f

SYN packets per second, and the system is designed to deal with this number without any performance issues.

If 's' exceeds 'f', the network infrastructure begins to show signs of overload. The system's response time

increases exponentially (24k), where 'k' represents each additional SYN packet above the ff limit. Now, considering 's=500' and different 'f values, in which scenario is the server most likely to experience overload and significantly increased response times?

Af=510: The server can handle 510 SYN packets per second, which is greater than what the attacker is sending. The system stays stable, and the response time remains unaffected

Bf=495: The server can handle 495 SYN packets per second. The response time drastically rises (245 = 32 times the normal), indicating a probable system overload

Cf=S05: The server can handle 505 SYN packets per second. In this case, the response time increases but not as drastically (245 = 32 times the normal), and the systern might still function, albeit slowly

Df=420: The server can handle 490 SYN packets per second. With 's' exceeding 'f by 10, the response time shoots up (2410 = 1024 times the usual response time), indicating a system overload
Explanation:
A SYN flood attack is a type of denial-of-service (DoS) attack that exploits the TCP handshake process by sending a large number of SYN requests to the target server, without completing the connection. This consumes the connection state tables on the server, preventing it from accepting new connections. The attacker has crafted an automated botnet to simultaneously send 's' SYN packets per second to the server. The server can handle 'f' SYN packets per second without any performance issues. If 's' exceeds 'f', the network infrastructure begins to show signs of overload. The system's response time increases exponentially (24k), where 'k' represents each additional SYN packet above the 'f' limit.
Considering 's=500' and different 'f' values, the scenario that is most likely to cause the server to experience overload and significantly increased response times is the one where 'f=420'. This is because 's' is greater than 'f' by 80 packets per second, which means the server cannot handle the incoming traffic and will eventually run out of resources. The response time shoots up (2480 = 281,474,976,710,656 times the normal response time), indicating a system overload.
The other scenarios are less likely or less severe than the one where 'f=420'. Option A has 'f=510', which is greater than 's', so the system stays stable and the response time remains unaffected. Option B has 'f=495', which is less than 's' by 5 packets per second, so the response time drastically rises (245 = 32 times the normal response time), indicating a probable system overload, but not as extreme as option D. Option C has 'f=505', which is less than 's' by 5 packets per second, so the response time increases but not as drastically (245 = 32 times the normal response time), and the system might still function, albeit slowly.Reference:
SYN flood DDoS attack | Cloudflare
SYN flood - Wikipedia
What Is a SYN Flood Attack? | F5
What is a SYN flood attack and how to prevent it? | NETSCOUT

Show Suggested Answer

Suggested Answer: D

by Edelmira at Feb 07, 2025, 05:39 PM

Limited Time Offer

25%

Off

Get Premium 312-50 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Ammie

4 months ago

I’m not sure about those numbers; they seem exaggerated.

upvoted 0 times

...

Brock

4 months ago

A is safe, but D is a disaster waiting to happen!

upvoted 0 times

...

Gearldine

4 months ago

Wait, how does D get such a crazy response time? Sounds off.

upvoted 0 times

...

Rory

4 months ago

I think B is pretty bad too, but not as extreme as D.

upvoted 0 times

...

Emiko

5 months ago

Option D is definitely the worst case here.

upvoted 0 times

...

Wenona

5 months ago

From what I recall, option A should be safe since 'f' is greater than 's', so the server should handle it fine.

upvoted 0 times

...

Kanisha

5 months ago

I practiced similar questions, and I think option C might still allow the server to function, but it's definitely not ideal.

upvoted 0 times

...

Marvel

5 months ago

I'm not entirely sure, but I feel like option B could also lead to overload since 'f' is just below 's'.

upvoted 0 times

...

Milly

5 months ago

I remember studying SYN flood attacks, and I think option D makes the most sense since 's' is way above 'f' there.

upvoted 0 times

...

Tammy

5 months ago

This is a classic SYN flood attack problem. I've seen these before, so I think I can tackle this one. I just need to focus on the numbers and how they relate to the server's capacity.

upvoted 0 times

...

Emerson

5 months ago

Hmm, the exponential response time increase is tricky. I'll need to do some calculations to determine which scenario is the worst case. I better review the formulas and examples in my notes to make sure I don't miss anything.

upvoted 0 times

...

Buffy

5 months ago

Okay, let me think this through. We need to compare the 's' value (500 SYN packets per second) to the different 'f' values and see which one results in the biggest response time increase. I'm pretty confident I can figure this out.

upvoted 0 times

...

Kristal

6 months ago

This question seems straightforward, but I want to make sure I understand the details before answering. The key seems to be determining which scenario has the server exceeding its capacity and experiencing the most significant response time increase.

upvoted 0 times

...

Dominga

1 year ago

Ah, the old SYN flood attack. Gotta hand it to the hackers, they really know how to make things interesting. Though I'd rather not be the one trying to explain the server meltdown to the boss.

upvoted 0 times

Marya

1 year ago

Yeah, it's a real headache. Especially when the server starts experiencing overload and the response time goes through the roof.

upvoted 0 times

...

Avery

1 year ago

Hmm, I'm torn between B and D. But I think D is the way to go. 1024 times the usual response time? That's like ordering a pizza and getting it delivered a month later.

upvoted 0 times

Dana

1 year ago

I think option B is also bad, but option D is definitely worse. The server will be overwhelmed with 1024 times the usual Dana time.

upvoted 0 times

...

Marylou

1 year ago

But what about option A with f=510? The server can handle that, right?

upvoted 0 times

...

Shala

1 year ago

420 SYN packets per second? What is this, a stoner's paradise? The server's going to be so high on latency, it won't even know what hit it.

upvoted 0 times

...

Odette

1 year ago

This is a tricky one, but I think the answer is definitely D. With 500 SYN packets per second and the server only able to handle 420, the response time is going to shoot up exponentially. I can practically hear the server crying out in pain.

upvoted 0 times