New Year Sale 2026! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Eccouncil 312-50 Exam - Topic 19 Question 89 Discussion

Actual exam question for Eccouncil's 312-50 exam
Question #: 89
Topic #: 19
[All 312-50 Questions]

An audacious attacker is targeting a web server you oversee. He intends to perform a Slow HTTP POST attack, by manipulating 'a' HTTP connection. Each connection sends a byte of data every 'b' second, effectively holding up the connections for an extended period. Your server is designed to manage 'm' connections per second, but any connections exceeding this number tend to overwhelm the system. Given 'a=100' and variable 'm', along with the attacker's intention of maximizing the attack duration 'D=a*b', consider the following scenarios. Which is most likely to result in the longest duration of server unavailability?

Show Suggested Answer Hide Answer
Suggested Answer: B

A Slow HTTP POST attack is a type of denial-of-service (DoS) attack that exploits the way web servers handle HTTP requests. The attacker sends a legitimate HTTP POST header to the web server, specifying a large amount of data to be sent in the request body. However, the attacker then sends the data very slowly, keeping the connection open and occupying the server's resources. The attacker can launch multiple such connections, exceeding the server's capacity to handle concurrent requests and preventing legitimate users from accessing the web server.

The attack duration D is given by the formula D = a * b, where a is the number of connections and b is the hold-up time per connection. The attacker intends to maximize D by manipulating a and b. The server can manage m connections per second, but any connections exceeding m will overwhelm the system. Therefore, the scenario that is most likely to result in the longest duration of server unavailability is the one where a > m and b is the largest. Among the four options, this is the case for option B, where a = 100, m = 90, and b = 15. In this scenario, D = 100 * 15 = 1500 seconds, which is the longest among the four options. Option A has a larger b, but a < m, so the server can handle the connections without being overwhelmed. Option C has a > m, but a smaller b, so the attack duration is shorter. Option D has a > m, but a smaller b and a smaller difference between a and m, so the attack duration is also shorter. Reference:

What is a Slow POST Attack & How to Prevent One? (Guide)

Mitigate Slow HTTP GET/POST Vulnerabilities in the Apache HTTP Server - Acunetix

What is a Slow Post DDoS Attack? | NETSCOUT


by Matt at Aug 07, 2024, 02:34 PM

Limited Time Offer

25%

Off

Get Premium 312-50 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Ty
3 months ago
Wait, how does 100 connections even work against 90? Sounds fishy!
upvoted 0 times
...
Twanna
3 months ago
C might surprise you, even with lower hold-up time, it's still a struggle.
upvoted 0 times
...
Ryann
3 months ago
A is definitely not a problem, server can handle that.
upvoted 0 times
...
Jaime
4 months ago
I think D is safe, 105 connections should hold up fine.
upvoted 0 times
...
Dick
4 months ago
B seems like the worst case, 100 connections over 90 is rough.
upvoted 0 times
...
Adelina
4 months ago
I thought option D would keep the server running fine since it can handle more connections than the attacker is sending, but I'm not completely confident about the hold-up time's impact.
upvoted 0 times
...
Cordelia
4 months ago
I practiced similar scenarios, and I feel like option B is definitely the worst case here because of the combination of too many connections and a longer hold-up time.
upvoted 0 times
...
Audry
4 months ago
I'm not entirely sure, but I think option C might not be as bad as it sounds since the hold-up time is lower, even if the server is overwhelmed.
upvoted 0 times
...
Mabel
5 months ago
I remember studying Slow HTTP attacks, and it seems like option B could lead to significant downtime since the server can't handle all 100 connections.
upvoted 0 times
...
Jenelle
5 months ago
Whoa, this is a lot of information to process. I'm not sure I fully understand how the different variables interact. I'll need to re-read the question carefully and maybe even sketch out some diagrams to visualize the scenarios.
upvoted 0 times
...
Marget
5 months ago
This is a tricky one, but I feel confident I can work through it. I'll start by calculating the attack duration for each scenario and then compare them to determine the most impactful one.
upvoted 0 times
...
Jolanda
5 months ago
Okay, I think I've got a good strategy for this. I'll focus on the scenario where the server's capacity is just barely exceeded by the attacker's connections, as that's likely to result in the longest duration of server unavailability.
upvoted 0 times
...
Brett
5 months ago
Hmm, I'm a bit confused by all the variables and numbers here. I'll need to really focus and break this down step-by-step to make sure I understand the implications of each scenario.
upvoted 0 times
...
Lakeesha
5 months ago
This question seems pretty straightforward. I think I can handle it by carefully analyzing the different scenarios and considering the impact of the attacker's connections on the server's capacity.
upvoted 0 times
...
Catherin
5 months ago
This question is really testing our understanding of the Sustainable Business Model Canvas. I think the best approach is to follow the sequence laid out in option C - it seems to hit all the key elements in a logical flow.
upvoted 0 times
...
Pete
5 months ago
I'm not entirely sure about this one. The Lessons Report seems like it could be relevant to the quality management system, but I'm not sure who specifically should use that information to refine the standards.
upvoted 0 times
...
Maryann
1 year ago
Well, at least the attacker isn't using a Slow Loris attack. That would be even more deliciously devious!
upvoted 0 times
...
Carin
1 year ago
105 connections per second is more than enough to handle the attacker's 100 connections, and the 12-second hold-up time is manageable. This seems like the best option.
upvoted 0 times
Ryan
1 year ago
Yeah, with 105 connections per second, the server should be able to handle the attack.
upvoted 0 times
...
Tula
1 year ago
I agree, option D seems like the best choice.
upvoted 0 times
...
...
Alaine
1 year ago
That's true, but the attacker's 100 connections could still cause some issues, especially if they are held up for a long time.
upvoted 0 times
...
Almeta
2 years ago
But what about option A? The server can handle 110 connections per second, so it might not be as bad as option B.
upvoted 0 times
...
Ludivina
2 years ago
95 connections per second is just not enough to handle the attacker's 100 connections, even with a lower hold-up time. I'd say this is the second-worst scenario.
upvoted 0 times
...
Shala
2 years ago
With the server only able to handle 90 connections per second and the attacker's 100 connections held up for 15 seconds each, this scenario is definitely the most problematic.
upvoted 0 times
Samuel
1 year ago
C) 95, b=10: Here, the server can handle 95 connections per second, but it falls short against the attacker's 100 connections, albeit the hold-up time per connection is lower
upvoted 0 times
...
Winfred
1 year ago
B) m=90, b=15: The server can manage 90 connections per second, but the attacker's 100 connections exceed this, and with each connection held up for 15 seconds, the attack duration could be significant
upvoted 0 times
...
Eden
1 year ago
A) m=110, b=20: Despite the attacker sending 100 connections, the server can handle 110 connections per second, therefore likely staying operative, regardless of the hold-up time per connection
upvoted 0 times
...
...
Ming
2 years ago
I agree with Alaine. With only 90 connections per second and each connection held up for 15 seconds, the server could be overwhelmed.
upvoted 0 times
...
Alaine
2 years ago
I think option B is the most likely to result in the longest duration of server unavailability.
upvoted 0 times
...
Nan
2 years ago
The server can handle 110 connections per second, so this scenario is the most likely to keep the server operational, even with the attacker's slow HTTP POST attack.
upvoted 0 times
Chantell
1 year ago
D) m=105, b=12: The server can manage 105 connections per second, more than the attacker's 100 connections, likely maintaining operation despite a moderate hold-up time
upvoted 0 times
...
Sylvia
1 year ago
C) 95, b=10: Here, the server can handle 95 connections per second, but it falls short against the attacker's 100 connections, albeit the hold-up time per connection is lower
upvoted 0 times
...
Gilberto
1 year ago
B) m=90, b=15: The server can manage 90 connections per second, but the attacker's 100 connections exceed this, and with each connection held up for 15 seconds, the attack duration could be significant
upvoted 0 times
...
Jutta
2 years ago
A) m=110, b=20: Despite the attacker sending 100 connections, the server can handle 110 connections per second, therefore likely staying operative, regardless of the hold-up time per connection
upvoted 0 times
...
...

Save Cancel