CS6262 Final Exam Prep 2026 | 200 Practice Questions with
Answers & Explanations | Cybersecurity Study Guide
1. An attacker uses a large botnet to make requests to a server to flood it with traffic. This is an example
of what type of attack?
A. Amplification attack
B. SYN flood attack
C. Application-layer flood
D. Link-layer flood
Answer: A
Explanation: An amplification attack occurs when an attacker uses a botnet to generate a flood of
requests, often exploiting services like NTP or DNS where a small request generates a large response
directed at the victim.
2. Which of the following statements about UDP-based NTP amplification attacks is CORRECT?
A. NTP runs on UDP port 123 and is vulnerable to source IP spoofing
B. NTP requires TCP handshakes, making amplification difficult
C. NTP responses are smaller than requests, preventing amplification
D. NTP uses authentication by default, blocking spoofing
Answer: A
Explanation: NTP servers are particularly vulnerable to amplification attacks because a small command
can generate a large response, and they are vulnerable to source IP spoofing. NTP runs on UDP port 123.
3. What is the primary mechanism by which SYN flood attacks overwhelm a target?
A. Exhausting CPU resources through encryption
B. Exhausting the server's connection queue by sending many SYN packets without completing the
handshake
C. Overwhelming network bandwidth with large UDP packets
D. Exploiting buffer overflow vulnerabilities in TCP stack
Answer: B
,Explanation: SYN flood attacks send a large number of SYN request packets to a server but never
complete the TCP three-way handshake, exhausting the server's half-open connection queue and
denying service to legitimate clients.
4. SYN cookies are used as a mitigation technique against SYN flood attacks. How do they work?
A. They drop all SYN packets from suspicious IP addresses
B. They remove state from the server by encoding connection information in the SYN-ACK packet
C. They require clients to solve computational puzzles before completing handshakes
D. They encrypt all TCP headers to prevent spoofing
Answer: B
Explanation: SYN cookies remove state from the server by encoding connection information in the SYN-
ACK packet, eliminating the need to maintain a half-open connection queue.
5. Which of the following is NOT a potential network-level DoS mitigation strategy?
A. CAPTCHAs
B. Client puzzles
C. SYN cookies
D. Firewall filtering
Answer: A
Explanation: CAPTCHAs are an application-layer mitigation designed to distinguish humans from bots.
Network-level mitigations include SYN cookies, client puzzles, and firewall filtering.
6. Which actor is most responsible for fueling counterfeit pharmaceutical goods in the cybercrime
ecosystem?
A. Exploit developers
B. Botnet masters
C. Consumers
D. Spammers
Answer: C
Explanation: Consumers who purchase counterfeit drugs from online pharmacies fuel the counterfeit
pharmaceutical market.
,7. An attacker commands a botnet to generate a flood of requests to a specific service. This is known as
a:
A. DoS flood (amplification attack)
B. SYN flood
C. Slowloris attack
D. Ping of death
Answer: A
Explanation: A DoS flood attack involves commanding botnets to generate a massive flood of requests
directed at a target server or service.
8. Which of the following makes the UDP-based NTP protocol particularly vulnerable to amplification
attacks? (Select all that apply)
A. It runs on a well-known port
B. A small command can generate a large response
C. It is vulnerable to source IP spoofing
D. It uses authentication by default
Answer: B, C
Explanation: NTP is vulnerable to amplification attacks because a small command can generate a large
response, and it is vulnerable to source IP spoofing. It is difficult to ensure computers only communicate
with legitimate NTP servers.
9. Which of the following statements about the Storm botnet is INCORRECT?
A. The Storm botnet uses a central command-and-control server
B. The Storm botnet is known for its peer-to-peer architecture
C. The Storm botnet has been used for spam distribution
D. The Storm botnet has a decentralized structure
Answer: A
Explanation: The Storm botnet is known for its peer-to-peer (decentralized) architecture, not a central
C&C server, which makes it more resilient to takedown efforts.
, 10. Which of the following is NOT an actor in the cybercrime underground economy?
A. Exploit developers
B. Botnet masters
C. System administrators
D. Spammers
Answer: C
Explanation: System administrators are security professionals, not typically part of the cybercrime
underground economy, which includes exploit developers, botnet masters, and spammers.
11. An amplification attack works by:
A. Sending a large number of SYN packets
B. Sending a small request to a server that generates a large response directed at the victim
C. Overloading the victim's CPU with encryption tasks
D. Exploiting buffer overflows in network stacks
Answer: B
Explanation: Amplification attacks exploit services like NTP or DNS where a small request triggers a
much larger response, and the attacker spoofs the victim's IP address to direct that response to the
victim.
12. Which of the following is an application-layer DoS mitigation technique?
A. SYN cookies
B. Client puzzles
C. Ingress filtering
D. Rate limiting at the router
Answer: B
Explanation: Client puzzles require the client to solve a computational problem before the server
allocates resources, making it an application-layer mitigation. SYN cookies are TCP-layer; ingress filtering
and rate limiting are network-layer.
13. Which type of IP spoofing generates random addresses within a given address space?
Answers & Explanations | Cybersecurity Study Guide
1. An attacker uses a large botnet to make requests to a server to flood it with traffic. This is an example
of what type of attack?
A. Amplification attack
B. SYN flood attack
C. Application-layer flood
D. Link-layer flood
Answer: A
Explanation: An amplification attack occurs when an attacker uses a botnet to generate a flood of
requests, often exploiting services like NTP or DNS where a small request generates a large response
directed at the victim.
2. Which of the following statements about UDP-based NTP amplification attacks is CORRECT?
A. NTP runs on UDP port 123 and is vulnerable to source IP spoofing
B. NTP requires TCP handshakes, making amplification difficult
C. NTP responses are smaller than requests, preventing amplification
D. NTP uses authentication by default, blocking spoofing
Answer: A
Explanation: NTP servers are particularly vulnerable to amplification attacks because a small command
can generate a large response, and they are vulnerable to source IP spoofing. NTP runs on UDP port 123.
3. What is the primary mechanism by which SYN flood attacks overwhelm a target?
A. Exhausting CPU resources through encryption
B. Exhausting the server's connection queue by sending many SYN packets without completing the
handshake
C. Overwhelming network bandwidth with large UDP packets
D. Exploiting buffer overflow vulnerabilities in TCP stack
Answer: B
,Explanation: SYN flood attacks send a large number of SYN request packets to a server but never
complete the TCP three-way handshake, exhausting the server's half-open connection queue and
denying service to legitimate clients.
4. SYN cookies are used as a mitigation technique against SYN flood attacks. How do they work?
A. They drop all SYN packets from suspicious IP addresses
B. They remove state from the server by encoding connection information in the SYN-ACK packet
C. They require clients to solve computational puzzles before completing handshakes
D. They encrypt all TCP headers to prevent spoofing
Answer: B
Explanation: SYN cookies remove state from the server by encoding connection information in the SYN-
ACK packet, eliminating the need to maintain a half-open connection queue.
5. Which of the following is NOT a potential network-level DoS mitigation strategy?
A. CAPTCHAs
B. Client puzzles
C. SYN cookies
D. Firewall filtering
Answer: A
Explanation: CAPTCHAs are an application-layer mitigation designed to distinguish humans from bots.
Network-level mitigations include SYN cookies, client puzzles, and firewall filtering.
6. Which actor is most responsible for fueling counterfeit pharmaceutical goods in the cybercrime
ecosystem?
A. Exploit developers
B. Botnet masters
C. Consumers
D. Spammers
Answer: C
Explanation: Consumers who purchase counterfeit drugs from online pharmacies fuel the counterfeit
pharmaceutical market.
,7. An attacker commands a botnet to generate a flood of requests to a specific service. This is known as
a:
A. DoS flood (amplification attack)
B. SYN flood
C. Slowloris attack
D. Ping of death
Answer: A
Explanation: A DoS flood attack involves commanding botnets to generate a massive flood of requests
directed at a target server or service.
8. Which of the following makes the UDP-based NTP protocol particularly vulnerable to amplification
attacks? (Select all that apply)
A. It runs on a well-known port
B. A small command can generate a large response
C. It is vulnerable to source IP spoofing
D. It uses authentication by default
Answer: B, C
Explanation: NTP is vulnerable to amplification attacks because a small command can generate a large
response, and it is vulnerable to source IP spoofing. It is difficult to ensure computers only communicate
with legitimate NTP servers.
9. Which of the following statements about the Storm botnet is INCORRECT?
A. The Storm botnet uses a central command-and-control server
B. The Storm botnet is known for its peer-to-peer architecture
C. The Storm botnet has been used for spam distribution
D. The Storm botnet has a decentralized structure
Answer: A
Explanation: The Storm botnet is known for its peer-to-peer (decentralized) architecture, not a central
C&C server, which makes it more resilient to takedown efforts.
, 10. Which of the following is NOT an actor in the cybercrime underground economy?
A. Exploit developers
B. Botnet masters
C. System administrators
D. Spammers
Answer: C
Explanation: System administrators are security professionals, not typically part of the cybercrime
underground economy, which includes exploit developers, botnet masters, and spammers.
11. An amplification attack works by:
A. Sending a large number of SYN packets
B. Sending a small request to a server that generates a large response directed at the victim
C. Overloading the victim's CPU with encryption tasks
D. Exploiting buffer overflows in network stacks
Answer: B
Explanation: Amplification attacks exploit services like NTP or DNS where a small request triggers a
much larger response, and the attacker spoofs the victim's IP address to direct that response to the
victim.
12. Which of the following is an application-layer DoS mitigation technique?
A. SYN cookies
B. Client puzzles
C. Ingress filtering
D. Rate limiting at the router
Answer: B
Explanation: Client puzzles require the client to solve a computational problem before the server
allocates resources, making it an application-layer mitigation. SYN cookies are TCP-layer; ingress filtering
and rate limiting are network-layer.
13. Which type of IP spoofing generates random addresses within a given address space?
