Welcome to this CEH v13 practice test!

This practice test covers Domain 4 (Network and Perimeter Hacking) Subdomain 3 (Denial-of-Service) from the CEH v13 (312-50v13) exam blueprint (v5).

These questions are inspired by the EC-Council CEH exam and are designed to help you test your knowledge of ethical hacking tools, techniques, and methodologies. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CEH exam.

Note: CEH and Certified Ethical Hacker are registered trademarks of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CEH practice tests based on specific domains and subdomains, click that link.

CEH v13 Domain 4.3 Practice Test 001
10 questions • 8 single-answer, 2 multi-select
CEH v13 (312-50v13) • Domain 4: Network and Perimeter Hacking — Sub-Domain 4.3: Denial-of-Service
Question 1
A security team detects a sudden spike in traffic targeting a public-facing web server. The traffic consists of a massive number of SYN packets from spoofed IP addresses, but the final ACK in the TCP handshake never arrives. The server begins to exhaust its connection table. What type of attack is being performed?
    Question 2
    During a penetration test, an ethical hacker uses a tool to send a large number of ICMP Echo Request packets to a target system, overwhelming its ability to respond. The system becomes unresponsive to legitimate users. Which attack is this?
      Question 3
      A hacker sends ICMP echo requests to a network's broadcast address with the source IP spoofed as the victim's IP. All hosts on the network reply to the victim simultaneously, overwhelming it. What type of attack is this?
        Question 4
        An attacker leverages publicly accessible DNS servers to send small queries that generate large responses directed at a victim system. The attacker spoofs the victim's IP address in the request. What type of attack is being executed?
          Question 5
          A penetration tester uses LOIC (Low Orbit Ion Cannon) to flood a target web server with HTTP requests from multiple systems. The attack overwhelms the application layer rather than the network layer. What type of DoS attack is this?
            Question 6
            Select all that apply
            A security analyst is reviewing defenses against distributed denial-of-service (DDoS) attacks. Which TWO mitigation techniques are MOST effective against volumetric DDoS attacks? (Choose two)
              Question 7
              An attacker sends overlapping IP fragments to a target system, causing the system to crash due to improper handling of packet reassembly. What type of attack is this?
                Question 8
                A network administrator notices that a server is receiving a high volume of UDP packets directed at random ports, causing it to respond with ICMP 'Destination Unreachable' messages. This results in resource exhaustion. What type of attack is occurring?
                  Question 9
                  A company experiences a DDoS attack originating from thousands of compromised IoT devices. The traffic is coordinated to overwhelm the company's infrastructure. What is this network of compromised devices called?
                    Question 10
                    Select all that apply
                    An ethical hacker is analyzing different categories of DoS attacks. Which TWO attacks are classified as protocol-based attacks? (Choose two)

                      Leave a Reply

                      Your email address will not be published. Required fields are marked *