Question

A network analyst reviewing traffic captures notices a large volume of ICMP echo replies flooding a single internal server. Investigation shows the ICMP echo requests were sent to the network's broadcast address with the victim server's IP spoofed as the source. Which type of attack does this pattern indicate?

Accepted Answer

An amplification-based denial-of-service attack that abuses directed broadcast to multiply traffic toward the spoofed victim

Answer

A man-in-the-middle attack that intercepts ICMP traffic between two hosts

Answer

A TCP SYN flood that exhausts the server's half-open connection table

Answer

A cross-site scripting attack delivered through crafted ICMP payloads