ISC2-CC - Network Security (24% of the exam) - Section 4.2

Identify common network threats and attacks, including denial-of-service, on-path (man-in-the-middle), spoofing, and side-channel attacks.

Recognise common network attacks - denial-of-service and distributed DoS, on-path (man-in-the-middle) interception, spoofing, and side-channel attacks - and the threat actors behind them. Match each attack to the security pillar it targets and to the control that best mitigates it.

Denial of serviceOn-path attackSpoofingThreat actorsNetwork attacks

Practice question for this objective

Free sampleNetwork Securitymedium

Two trainees debate the difference between a SYN flood and an on-path attack. Which statement correctly identifies the primary goal that separates a SYN flood from an on-path attack?

AA SYN flood decrypts TLS sessions in transit, while an on-path attack merely counts the open ports on the target host.
BA SYN flood exhausts a server's half-open connection table to deny service, while an on-path attack intercepts a live conversation. Correct
CA SYN flood forges email headers to fool users, while an on-path attack simply guesses passwords from a stored wordlist.
DA SYN flood installs ransomware on the host, while an on-path attack disables the firewall's logging service entirely.

A SYN flood targets availability by exhausting half-open connections, whereas an on-path attack targets confidentiality and integrity by intercepting traffic. The TCP three-way handshake lets a SYN flood tie up the backlog of half-open connections so legitimate clients cannot connect, a denial-of-service goal, while an on-path attack instead seeks to read or alter an ongoing exchange.

Why A is wrong: A SYN flood does not decrypt anything and on-path attacks do more than count ports, so this statement misattributes capabilities to both techniques.

Why B is correct: A SYN flood leaves many TCP handshakes half-open to exhaust connection resources and deny availability, whereas an on-path attack targets confidentiality and integrity by interposing on traffic, which is the correct goal-based distinction.

Why C is wrong: Forged email headers describe spoofing and wordlist guessing describes brute force, so neither half correctly labels a SYN flood or an on-path attack.

Why D is wrong: Neither ransomware installation nor disabling logging is the defining purpose of these attacks, so this pairing describes unrelated activities and misses the real distinction.

See more ISC2-CC practice questions, answers explained.

Exam traps in Network Security

Answers that look right on this material and are not. Each one is a distractor from a different question in the ISC2-CC bank for this domain.

A denial-of-service attack, because redirecting the traffic through the laptop is intended to overwhelm the gateway and make the network unavailable to everyone.
Why it is wrong: The goal here is interception and modification, not exhaustion; the network still works, which rules out a denial-of-service whose aim is loss of availability.
Require each staff member to choose a longer, more complex password for the patient portal before connecting over public networks.
Why it is wrong: Stronger passwords resist guessing but travel inside the session; if the channel is intercepted they offer no protection against an on-path attacker reading or changing traffic.
It secretly reads sensitive data as it passes between two hosts on the network
Why it is wrong: Reading data in transit is an attack on confidentiality carried out by interception, not the resource exhaustion that defines a denial-of-service attack.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.