Free Preparation Discussions
MENU
Cisco 200-201 Exam - Topic 5 Question 99 Discussion
Topic #: 5
Refer to exhibit.
An engineer is Investigating an Intrusion and Is analyzing the pcap file. Which two key elements must an engineer consider? (Choose two.)
The exhibit shows a pcap file capturing multiple TCP SYN packets directed at the same destination IP address.
High volume of SYN packets with very little variance in time: This pattern is indicative of a SYN flood attack, a type of Denial of Service (DoS) attack where numerous SYN requests are sent to overwhelm the target system.
SYN packets acknowledged from several source IP addresses: This can be indicative of a Distributed Denial of Service (DDoS) attack where multiple compromised hosts (botnet) are used to generate traffic.
These characteristics suggest that the network is under a SYN flood or DDoS attack, aiming to exhaust the target's resources and disrupt service availability.
Understanding SYN Flood Attacks
Analysis of DDoS Attack Patterns
Wireshark Analysis Techniques for Intrusion Detection
Krystina
9 months agoVal
9 months agoLynelle
10 months agoDeeanna
10 months agoGlenn
10 months agoAbraham
10 months agoJolene
11 months agoKanisha
11 months agoGail
11 months agoLauryn
11 months agoDouglass
11 months agoDerick
11 months agoPamella
11 months agoBlair
11 months agoDominque
2 years agoJudy
2 years agoSlyvia
2 years agoLucina
2 years agoJustine
2 years agoCherry
2 years agoCarla
2 years agoMisty
2 years agoArminda
2 years agoXochitl
2 years agoLizbeth
2 years agoBobbye
2 years agoDenise
2 years agoShenika
2 years agoKristin
2 years agoCarey
2 years agoCarrol
2 years ago