Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

ISC2 SSCP Exam - Topic 1 Question 42 Discussion

Posted by Josphine on May 09, 2022 at 05:24 PM

What attack involves the perpetrator sending spoofed packet(s) wich contains the same destination and source IP address as the remote host, the same port for the source and destination, having the SYN flag, and targeting any open ports that are open on the remote host?

Suggested Answer: B

The Land attack involves the perpetrator sending spoofed packet(s) with the SYN flag set to the victim's machine on any open port that is listening. The packet(s) contain the same destination and source IP address as the host, causing the victim's machine to reply to itself repeatedly. In addition, most systems experience a total freeze up, where as CTRL-ALT-DELETE fails to work, the mouse and keyboard become non operational and the only method of correction is to reboot via a reset button on the system or by turning the machine off.

The Boink attack, a modified version of the original Teardrop and Bonk exploit programs, is very similar to the Bonk attack, in that it involves the perpetrator sending corrupt UDP packets to the host. It however allows the attacker to attack multiple ports where Bonk was mainly directed to port 53 (DNS).

The Teardrop attack involves the perpetrator sending overlapping packets to the victim, when their machine attempts to re-construct the packets the victim's machine hangs.

A Smurf attack is a network-level attack against hosts where a perpetrator sends a large amount of ICMP echo (ping) traffic at broadcast addresses, all of it having a spoofed source address of a victim. If the routing device delivering traffic to those broadcast addresses performs the IP broadcast to layer 2 broadcast function, most hosts on that IP network will take the ICMP echo request and reply to it with an echo reply each, multiplying the traffic by the number of hosts responding. On a multi-access broadcast network, there could potentially be hundreds of machines to reply to each packet.

Resources:

http://en.wikipedia.org/wiki/Denial-of-service_attack

http://en.wikipedia.org/wiki/LAND


Get Premium SSCP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test
11 comments · newest first
CA
Cassie 11 months ago
Wait, are we sure about that? Sounds too simple.
MA
Maryann 12 months ago
Pretty sure it's Land attack, can't be wrong.
JE
Jessenia 12 months ago
No way, it's the Teardrop attack!
CA
Carissa 12 months ago
I thought it was a Smurf attack at first.
GE
Georgiann 1 year ago
That's definitely a Land attack!
AL
Allene 1 year ago
I feel like the Smurf attack is related to ICMP, so it can't be the answer. I'm pretty confident it's the Land attack.
GE
Gerri 1 year ago
The details about the spoofed packets and SYN flag make me lean towards the Land attack, but I could be mixing it up with another type.
LU
Luisa 1 year ago
I remember practicing a question about a similar attack, but I can't recall the exact name. Was it the Teardrop attack?
LA
Larae 1 year ago
I think this might be a Land attack, but I'm not completely sure. The description sounds familiar.
SL
Slyvia 1 year ago
Ah, I see the issue now. Restrict Anonymous 1 isn't enough - I'll need to dig deeper into the different settings and how they impact null session prevention. This is a good learning opportunity.
QU
Quentin 1 year ago
I practiced a question kind of like this once, and I think all factors like benefits and group size count when underwriting premiums.
0/2000 characters

Save Cancel