ECCouncil Updated 212-89 Exam Questions and Answers by georgina

Comprehensive and Detailed Explanation (ECIH-aligned):

This scenario describes a SYN flood attack, a classic protocol-level Denial-of-Service technique covered in the ECIH Network Security Incidents module. In a SYN flood, attackers send a large volume of TCP SYN packets but never complete the three-way handshake, leaving the server waiting for responses and exhausting connection resources.

Option D is correct because incomplete TCP handshakes, half-open connections, and resource exhaustion are defining characteristics of SYN flood attacks. The presence of multiple source IPs further suggests a distributed attack.

Option A involves taking over an existing session, not exhausting resources. Option B applies to UDP-based amplification attacks. Option C affects DNS resolution, not TCP handshakes.

ECIH stresses that early identification of SYN floods allows defenders to deploy SYN cookies, rate limiting, and upstream filtering. Recognizing handshake anomalies is therefore critical in protecting service availability.

Comprehensive and Detailed Explanation (ECIH-aligned):

ECIH prioritizes containment of the most critical threat vector. The primary server actively exfiltrating data represents the highest risk.

Option B is correct because isolating the primary server immediately stops data loss and attacker control. IoT remediation can follow once core assets are secured.

Options A and D delay containment. Option C causes unnecessary disruption.

ECIH stresses that responders must address the most damaging threat first, making Option B correct.

The Slowloris attack is a type of application-layer attack that targets the web server by establishing and maintaining many simultaneous HTTP connections to the target server. Unlike traditional network-layer DoS/DDoS attacks such as UDP flood or SYN flood, Slowloris is designed to hold as many connections to the target web server open for as long as possible. It does so by sending partial requests, which are never completed, and periodically sending subsequent HTTP headers to keep the connections open. This consumes the server's resources, leading to denial of service as legitimate users cannot establish connections. The Slowloris attack is effective even against servers with a high bandwidth because it targets the server's connection pool, not its network bandwidth.