FirstTry

Exam objective

CEH

Denial-of-Service

This objective sits in Network and Perimeter Hacking, which carries 24% of the CEH exam. The questions below are original, written from the official objective title above, and each explanation cites the EC-Council page it rests on.

Objective title verbatim from the official objectives. EC-Council exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

Network and Perimeter Hacking

A web server stops accepting new connections during a flood, although link utilization and free memory both look normal. Which resource is the attack exhausting?

The physical memory available to the hostHost memory is protected by the very limit being filled, which is why free memory still reads normal.
The application's pool of worker threadsWorker threads are consumed by requests that completed a handshake, and these connections never do.
The upstream link bandwidth serving the data centerA volumetric attack would show the circuit saturated, and the reported utilization is unremarkable.
The backlog of half-open connections on that portCorrect · your answerCorrect.

Correct.

Checked against rfc-editor.org, September 2026

Concept

A flood does not have to be large to be effective. Every listening socket keeps a bounded queue for connections that have been started and not completed, and filling that queue is enough to refuse everyone else.

Why D

Normal bandwidth and normal memory rule out volumetric and host exhaustion, which leaves the per-port queue holding connections stuck partway through the handshake.

Source

The SYN flooding attack does not attempt to overload the network's resources or the end host's memory, but merely attempts to exhaust the backlog of half-open connections associated with a port number.

RFC Editor, RFC 4987 TCP SYN Flooding Attacks and Common Mitigations, checked September 2026
#syn-flood#half-open-connections#tcp-backlog

Now you: practice questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

Network and Perimeter Hacking

An analyst models how little traffic a SYN flood needs to keep a listener unavailable. Which value sets that floor?

Sample question 2 of 3

Network and Perimeter Hacking

A flood carries spoofed sources that belong to live, reachable hosts, and the victim keeps serving clients throughout. Which response from those hosts explains it?

Sample question 3 of 3

Network and Perimeter Hacking

During a SYN flood against a web listener, an administrator finds established sessions still working and outbound connections unaffected. Why is that expected?

That’s 3 of the full CEH bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Network and Perimeter Hacking