Question

A SOC analyst reviews NetFlow data and observes thousands of inbound TCP packets to a web server, all with only the SYN flag set and spoofed source addresses. The server's connection table is filling up, and legitimate users report the site is unreachable. No SYN-ACK responses are being completed with an ACK. Which type of attack best describes this activity?

Accepted Answer

SYN flood denial-of-service attack that exhausts the server's half-open connection resources

Answer

Man-in-the-middle attack intercepting the TCP handshake between clients and the server

Answer

SQL injection attack targeting the web application's backend database

Answer

DNS tunneling used to exfiltrate data over an established covert channel