ExamworthyExamworthy
Open the appStart free

ISC2-CC - Network Security - Section 4.2

Identify common network threats and attacks, including denial-of-service, on-path (man-in-the-middle), spoofing, and side-channel attacks.

Recognise common network attacks - denial-of-service and distributed DoS, on-path (man-in-the-middle) interception, spoofing, and side-channel attacks - and the threat actors behind them. Match each attack to the security pillar it targets and to the control that best mitigates it.

Denial of serviceOn-path attackSpoofingThreat actorsNetwork attacks

Practice question for this objective

Free sampleNetwork Securitymedium

Two trainees debate the difference between a SYN flood and an on-path attack. Which statement correctly identifies the primary goal that separates a SYN flood from an on-path attack?

  • AA SYN flood decrypts TLS sessions in transit, while an on-path attack merely counts the open ports on the target host.
  • BA SYN flood exhausts a server's half-open connection table to deny service, while an on-path attack intercepts a live conversation. Correct
  • CA SYN flood forges email headers to fool users, while an on-path attack simply guesses passwords from a stored wordlist.
  • DA SYN flood installs ransomware on the host, while an on-path attack disables the firewall's logging service entirely.
A SYN flood targets availability by exhausting half-open connections, whereas an on-path attack targets confidentiality and integrity by intercepting traffic. The TCP three-way handshake lets a SYN flood tie up the backlog of half-open connections so legitimate clients cannot connect, a denial-of-service goal, while an on-path attack instead seeks to read or alter an ongoing exchange.

Why A is wrong: A SYN flood does not decrypt anything and on-path attacks do more than count ports, so this statement misattributes capabilities to both techniques.

Why B is correct: A SYN flood leaves many TCP handshakes half-open to exhaust connection resources and deny availability, whereas an on-path attack targets confidentiality and integrity by interposing on traffic, which is the correct goal-based distinction.

Why C is wrong: Forged email headers describe spoofing and wordlist guessing describes brute force, so neither half correctly labels a SYN flood or an on-path attack.

Why D is wrong: Neither ransomware installation nor disabling logging is the defining purpose of these attacks, so this pairing describes unrelated activities and misses the real distinction.

See more ISC2-CC practice questions with worked answers.

More in this domain

Back to all Network Security objectives, or the ISC2-CC cert hub.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.