What type of attack sends SYN requests to a target system with spoofed IP addresses?

• A. Ping of death
• B. Cross site scripting
• C. SYN flood
• D. Land

Answer: (C)

This question is about how a SYN flood works to exhaust a target’s resources. In a SYN flood, a flood of TCP SYN packets is sent to the server, but with spoofed (fake) source IP addresses. The server replies to each SYN with a SYN-ACK to those spoofed addresses and waits for the final ACK to complete the three-way handshake. Since the attacker never sends the ACKs, those connections stay half-open and occupy server resources (the backlog/half-open connection state). As this continues, legitimate clients can’t establish new connections, leading to denial of service. Spoofing makes it harder to trace and block since replies go to many different (fake) destinations.

This differs from the other options: Ping of Death uses oversized ICMP packets; cross-site scripting exploits a web app’s input; Land attack sends a packet with the same IP address for both source and destination to induce the target to respond to itself.