Free Preparation Discussions
MENU
Cisco Exam 200-201 Topic 5 Question 99 Discussion
Topic #: 5
Refer to exhibit.
An engineer is Investigating an Intrusion and Is analyzing the pcap file. Which two key elements must an engineer consider? (Choose two.)
The exhibit shows a pcap file capturing multiple TCP SYN packets directed at the same destination IP address.
High volume of SYN packets with very little variance in time: This pattern is indicative of a SYN flood attack, a type of Denial of Service (DoS) attack where numerous SYN requests are sent to overwhelm the target system.
SYN packets acknowledged from several source IP addresses: This can be indicative of a Distributed Denial of Service (DDoS) attack where multiple compromised hosts (botnet) are used to generate traffic.
These characteristics suggest that the network is under a SYN flood or DDoS attack, aiming to exhaust the target's resources and disrupt service availability.
Understanding SYN Flood Attacks
Analysis of DDoS Attack Patterns
Wireshark Analysis Techniques for Intrusion Detection
Dominque
2 months agoJudy
2 months agoSlyvia
1 months agoLucina
2 months agoJustine
2 months agoCherry
2 months agoCarla
2 months agoMisty
1 months agoArminda
1 months agoXochitl
2 months agoLizbeth
2 months agoBobbye
2 months agoDenise
3 months agoShenika
3 months agoKristin
3 months agoCarey
2 months agoCarrol
3 months ago