CEH v13 Denial-of-Service Practice Questions 2026

Volume, protocol, and application-layer attacks: SYN floods, amplification, botnets, and DDoS mitigation strategies. Exam focus: separate DoS from DDoS and volumetric from protocol-based attacks, and know exactly what a SYN flood exhausts. Amplification questions (DNS/NTP reflection) test whether you can identify the traffic asymmetry that makes them work.

⚠️ Important Disclaimer: These practice questions are original study material created by CEHStudy for educational purposes. They are NOT EC-Council exam questions and do NOT replicate the actual exam. CEHStudy is not affiliated with or endorsed by EC-Council.

Question 1: The primary difference between a DoS and a DDoS attack is:

A) DDoS originates from many compromised systems (botnet) while DoS comes from a single source B) DoS is always legal and DDoS is not C) DDoS requires no traffic at all D) DDoS uses only UDP traffic

Answer: A — Many distributed sources make DDoS far harder to block — blocking one IP stops a DoS, not a DDoS.

Question 2: A SYN flood fills the target's connection table with:

A) Fully established TCP sessions B) ICMP echo replies C) DNS lookups D) Half-open connections that never complete the three-way handshake

Answer: D — SYNs are sent but never acknowledged, so slots sit waiting until legitimate users can't connect — mitigated by SYN cookies and rate limiting.

Question 3: A Smurf attack sends:

A) TCP SYN packets from one machine B) ICMP echo requests to a broadcast address with a spoofed victim source IP C) UDP fragments toward port 19 D) ARP queries across subnets

Answer: B — Every host on the broadcast domain replies to the 'victim' — amplification equals the number of hosts; modern networks block directed broadcast.

Question 4: Slowloris is a Layer 7 attack because it:

A) Floods the link with raw bandwidth B) Hijacks DNS resolution C) Holds many HTTP connections open with partial requests until the server's connection slots are exhausted D) Corrupts packet checksums in transit

Answer: C — It consumes application-level resources (connections), not bandwidth — so it needs little traffic and evades volumetric defenses.

Question 5: DNS amplification attacks work by:

A) Sending small queries with a spoofed victim source IP to open resolvers, whose much larger responses all hit the victim (amplification ~30x) B) Reflecting TCP SYN packets off the victim C) Poisoning BGP routes to the victim's ASN D) Fragmenting packets until they crash the NIC

Answer: A — Mitigations: disable open resolvers, source validation (BCP38/BCP84), and upstream scrubbing.

Question 6: Which category of DDoS attack includes SYN floods and Smurf?

A) Protocol (state-exhaustion) attacks B) Zero-day protocol attacks C) Application-layer (Layer 7) attacks D) Volumetric (bandwidth) attacks

Answer: A — Protocol attacks exhaust connection state and resources (SYN flood, Smurf, Ping of Death); volumetric uses bandwidth floods; L7 targets app logic (Slowloris).

Question 7: A 'Ping of Death' attack:

A) Physically disables network interface cards B) Spoofs every MAC address on the LAN C) Sends oversized or malformed ICMP packets (>65,535 bytes) that crash systems reassembling them D) Floods the target with minimal-size pings

Answer: C — Legacy and IoT stacks still mishandle reassembly of giant fragmented echoes — mostly patched in modern OSes.

Question 8: LOIC and HOIC are examples of:

A) Basic traffic-flood (stresser) tools B) Intrusion prevention system signature packs C) Anti-DDoS appliances from cloud providers D) Content delivery networks

Answer: A — 'Low/High Orbit Ion Cannon' generate simple floods — the same engines behind commercial 'booter/stresser' abuse services.

Question 9: Anycast networking helps mitigate DDoS by:

A) Blocking all ICMP protocol traffic B) Running a single hardened server with the biggest firewall C) Disabling DNS for the protected site D) Distributing incoming traffic across multiple geographically dispersed data centers sharing one address

Answer: D — Attack volume is spread thin across the anycast footprint, and nearby edge locations absorb regional floods.

Question 10: Fraggle attacks are similar to Smurf but use:

A) TCP ACK packets B) BGP route updates C) UDP echo requests instead of ICMP D) ARP broadcast frames

Answer: C — Fraggle = the UDP variant of Smurf: broadcast UDP echo with spoofed victim source, amplifying replies at the target.

Related Glossary Terms

Continue Your CEH v13 Prep

Frequently Asked Questions

How many CEH v13 Denial-of-Service Attacks practice questions are on this page?

This page includes 10 original multiple-choice practice questions for CEH v13 Module 10 (Denial-of-Service Attacks). Each question includes a detailed explanation of the correct answer and why the other options are wrong. The full CEHStudy question bank covers all 20 modules with 200+ questions — see the practice hub at https://cehstudy.com/ceh-practice-questions/ for every module.

What does CEH v13 Module 10 (Denial-of-Service Attacks) cover?

Volume, protocol, and application-layer attacks: SYN floods, amplification, botnets, and DDoS mitigation strategies. These are the same topics tested under this module on the EC-Council 312-50 exam. Pair this quiz with our free Module 10 flashcards at https://cehstudy.com/ceh-v13/module-10/ to close any gaps.

Are these real CEH exam questions?

No. Every question on CEHStudy is original study material written for exam preparation. They match the style, difficulty, and domain coverage of the actual CEH v13 exam but are not leaked or reproduced EC-Council questions.

How should I use this Denial-of-Service Attacks quiz for exam prep?

Answer all 10 questions without peeking at explanations, then click "Show My Score". Review every explanation — especially the ones you missed — and re-test those topics with our free CEH flashcards. Aim for 80% or higher on module quizzes before scheduling the exam.

Where do I find CEH Denial-of-Service Attacks flashcards?

Our free flashcard app covers all 20 CEH v13 modules including Module 10 (Denial-of-Service Attacks). Visit the CEH flashcards page at https://cehstudy.com/ or the Module 10 page at https://cehstudy.com/ceh-v13/module-10/. No account or sign-up required.

CEH v13 Module 10: Denial-of-Service Attacks — Free Practice Questions with Explanations