Which attack floods the server by sending a high volume of SYN-ACK packets in response to client SYNs, attempting to exhaust resources during the handshake?

• A. SYN Flood Attack
• B. HTTP POST Attack
• C. SYN-ACK Flood Attack
• D. Multiple ACK Spoofed Session Flood Attack

Answer: (C)

The concept being tested is how resources are consumed during the TCP handshake. When a client sends a SYN, the server must allocate state and respond with a SYN-ACK while waiting for the final ACK. Flooding the server with a high volume of SYN-ACK responses in reaction to incoming SYNs drives the target to generate many handshake responses, consuming CPU, memory, and backlog queue space. This type of activity is known as a SYN-ACK flood attack, because the attack overwhelms the server by inundating it with synchronization-acknowledgment packets during the handshake. The other options describe different attack vectors—an HTTP POST attack targets application data, while a spoofed-ACK session flood disrupts established sessions rather than the handshake itself.