Chapter 45 · Quiz

Denial of Service Quiz

Seven questions covering DoS types, botnets, DNS amplification math, asymmetric threats, and the smokescreen use case.

Q1. At its peak, a single botnet had over 3.6 million infected computers under its operator's control. The operator could direct all of them to attack a target simultaneously by sending one command to the command-and-control infrastructure. Which botnet is this?

A. Mirai B. Zeus C. Conficker D. Storm Worm

Q2. An attacker's botnet devices send DNS queries of approximately 15 bytes each to open DNS resolvers. The source IP in each query is forged to show the victim's address. Each resolver responds with approximately 1,300 bytes sent directly to the victim. What is the approximate amplification factor, and what type of attack is this?

A. Amplification factor of 15×; NTP amplification attack B. Amplification factor of 550×; DNS reflection attack C. Amplification factor of approximately 86×; DNS amplification attack D. Amplification factor of 86×; NTP amplification attack

Q3. A security operations center receives alerts for a massive DDoS attack consuming all external bandwidth. While the team responds to the traffic flood, a separate analyst discovers that the organization's external DNS MX records have been modified to redirect email to an attacker-controlled server — a change that went undetected during the attack response. Which DoS motivation does this scenario BEST illustrate?

A. Smokescreen — the DDoS was used to distract the security team while the real attack (DNS modification) was executed B. Competitive advantage — the attacker removed the organization from the internet to benefit a rival C. Friendly DoS — the DNS records were modified accidentally during the incident response D. Amplification — the DNS modification was part of the attack traffic generation chain

Q4. A junior network technician connects a new access switch to two existing access switches for redundancy. Within two minutes, all devices on that network segment lose connectivity. No security alerts fire and the internet connection is functioning normally. The outage started immediately after the technician finished the cabling. Which type of DoS is this, and what is the most likely cause?

A. A DDoS attack — multiple switches are participating in flooding the segment B. A friendly DoS — a Layer 2 loop without Spanning Tree Protocol is generating a broadcast storm that consumes all segment bandwidth C. A vulnerability-based DoS — the new switch has a software flaw that crashed the network D. DNS amplification — the new switch is generating excessive DNS queries

Q5. An attacker with a single laptop and minimal personal bandwidth controls a botnet of 800,000 infected devices globally. Using this botnet, they generate enough traffic to take down a major cloud provider operating thousands of servers and 500 Gbps of internet capacity. Which property of DDoS attacks does this BEST demonstrate?

A. Amplification — the attacker's traffic is being reflected and multiplied by DNS servers B. Reflection — the traffic is being bounced off legitimate third-party servers toward the victim C. Asymmetric threat — the attacker has far fewer personal resources than the victim but overwhelms them by aggregating hundreds of thousands of distributed compromised devices D. Friendly DoS — the cloud provider's own infrastructure is generating the traffic due to a misconfiguration

Q6. An attacker is planning a DDoS amplification attack and needs to choose the most effective protocol. Which protocol offers the highest amplification factor due to its MONLIST command, which returns a list of the last 600 hosts that queried the server?

A. DNS — ANY queries return all available record types with an amplification factor of up to ~86× B. NTP — the MONLIST command returns a large response relative to a tiny request, with an amplification factor of up to ~550× C. ICMP — ping responses generate larger packets than the original request due to header overhead D. HTTP — web server responses include full page content, providing a large amplification factor

Q7. Match each DoS concept to its correct description.

Click each term on the left, then click its match on the right.

Match each item on the left with its correct description on the right:

DDoS

Amplification

Botnet

Friendly DoS

A. Compromised devices under attacker control, directed by C2 infrastructure to attack any target simultaneously with a single command

B. Unintentional service disruption caused by misconfiguration or infrastructure failure — Layer 2 loop, bandwidth saturation, broken water pipe

C. Attack using many distributed sources simultaneously, exploiting the asymmetric advantage of aggregating many small contributors against one large target

D. Technique where small requests to intermediary services generate much larger responses directed at the victim via IP spoofing

Click an item on the left to select it, then click its match on the right.