Free Network and Credential Attacks practice questions
10 free SY0-801 questions on Network and Credential Attacks, each with a full explanation — no account needed. This section sits in the Threats, Vulnerabilities, and Attacks part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
Which resource does a volumetric DDoS attack try to exhaust?
A volumetric attack sends more traffic than the link can carry, so the exhausted resource is bandwidth, and the fix sits upstream at the ISP or a scrubbing provider. Connection state is what a protocol attack such as a SYN flood exhausts, server CPU and database work is what an application-layer flood ties up, and session keys are not a resource an attacker floods.
A server's connection backlog fills with half-open TCP connections stuck in SYN-RECV from addresses that never send the final ACK, and new users are refused. Which attack is this, and the standard defense?
Half-open connections piling up in SYN-RECV from clients that never finish the handshake is the SYN flood signature, and SYN cookies let the server store nothing until a valid ACK returns. A web application firewall addresses layer 7 floods, while scrubbing and closing resolvers address bandwidth-filling volumetric and reflection attacks, not an exhausted state table.
To build the largest possible reflected and amplified UDP flood, which exposed service has historically given attackers the greatest amplification?
Internet-exposed memcached has amplified traffic by tens of thousands of times, the largest factor seen, and it drove the 1.35 Tbps attack on a major site in 2018. Open DNS resolvers return responses dozens of times larger than the query, and the legacy NTP monitoring command several hundred times, so both are real reflectors but far smaller. SNMP can be reflected too, but its replies are only a few times larger than the request.
A TLS inspection log shows a client that normally negotiates TLS 1.3 completing a handshake at TLS 1.0 with an export-grade cipher, and a capture shows its first offer followed by retries at lower versions. Which attack is this, and what removes the exposure?
Negotiating an old TLS version and a weak cipher, with retries stepping down from the client's first offer, is a protocol downgrade, and a downgrade can only reach versions both sides still accept, so removing them is the fix. SSL stripping would show plain HTTP with no certificate at all, not an older TLS version, so HSTS targets the wrong attack here.
A web service becomes unreachable. Inbound bandwidth is well within normal, but the stateful firewall in front of it reports its session table is completely full. Which DDoS family does this point to?
A full session table while bandwidth stays normal is the mark of a protocol attack, which exhausts state in servers, firewalls, and load balancers rather than filling the pipe. A volumetric attack would saturate bandwidth, a layer 7 flood would overload the application's CPU or database, and a flash crowd would show real users converting.
On a network served by one DHCP server, clients suddenly receive an address, gateway, and DNS server all in an unexpected range, and a capture shows two servers answering the same DHCP request. Which attack is this, and the switch feature that stops it?
Clients getting the wrong gateway and DNS from a second server answering DHCP is a rogue DHCP server, and DHCP snooping fixes it by allowing DHCP replies only from trusted ports. ARP poisoning changes cached address mappings rather than handing out settings, and MAC flooding and evil twins attack switches and wireless clients, not DHCP.
An attacker on a shared segment captures traffic and recovers a switch administrator's password from a management session. Which kind of protocol made this possible, and the best remedy?
If a password can be read straight from captured traffic, the protocol sent it in cleartext, and the fix is its encrypted replacement, here SSH in place of Telnet. A longer password still crosses the wire in the clear and is captured just the same, and the session was never encrypted, so the choices that call it encrypted do not fit the facts.
A packet arrives on the firewall's internet-facing interface carrying a source address from the internal 10.0.0.0/8 range. Which activity does this indicate, and the control that drops it?
An internal source address arriving from the outside could not legitimately be there, which is IP spoofing, and anti-spoofing filters with unicast reverse path forwarding drop packets whose source is not reachable through the interface they came in on. ARP and MAC attacks forge link-layer identifiers on the local segment, not the source IP seen at the edge.
An attacker floods a switch's address table with thousands of bogus MAC entries until the switch can no longer learn new ones and begins flooding frames out every port like a hub. Which attack is this, and the feature that prevents it?
Overfilling the switch's MAC table so it floods every frame is MAC flooding, and port security prevents it by limiting how many MAC addresses a port may learn. ARP poisoning corrupts hosts' ARP caches, IP spoofing forges source addresses, and rogue DHCP hands out bad settings, so none of their controls apply to a full switch table.
On a cafe network, a user clicks through a certificate warning on a banking site that normally loads without one, then notices extra latency and an unexpected extra hop in a traceroute to a local server. Which attack do these indicators point to, and how is it told apart from SSL stripping?
A certificate warning on a normally clean site, plus added latency and an extra local hop, points to an on-path attacker presenting a forged certificate. SSL stripping keeps the victim on plain HTTP and presents no certificate at all, so it produces no warning, which is exactly what separates the two attacks.
Study this section
Every lesson that covers Network and Credential Attacks on the SY0-801 exam.