Slow HTTP POST Attack Duration Calculation

312-50v12 By islever Editorial Last updated

Denial-of-Service

Short answer

A The scenario m=90, b=15 results in the longest server unavailability because the server is overwhelmed (100 > 90) and the total duration (1500s) is maximized.

Question

An audacious attacker is targeting a web server you oversee. He intends to perform a Slow HTTP POST attack, by manipulating 'a' HTTP connection. Each connection sends a byte of data every 'b' second, effectively holding up the connections for an extended period. Your server is designed to manage 'm' connections per second, but any connections exceeding this number tend to overwhelm the system. Given 'a=100' and variable 'm', along with the attacker's intention of maximizing the attack duration 'D=a*b', consider the following scenarios. Which is most likely to result in the longest duration of server unavailability?
  1. m=90, b=15: The server can manage 90 connections per second, but the attacker's 100 connections exceed this, and with each connection held up for 15 seconds, the attack duration could be significant. Correct Answer
  2. m=105, b=12: The server can manage 105 connections per second, more than the attacker's 100 connections, likely maintaining operation despite a moderate hold-up time.
  3. m=110, b=20: Despite the attacker sending 100 connections, the server can handle 110 connections per second, therefore likely staying operative, regardless of the hold-up time per connection.
  4. m=95, b=10: Here, the server can handle 95 connections per second, but it falls short against the attacker's 100 connections, albeit the hold-up time per connection is lower.

Key Takeaways

The core test is identifying the scenario where the number of attacker connections exceeds the server's limit (m < a) while simultaneously maximizing the product of connections and time per connection (D = a * b).

This question evaluates the impact of Slow HTTP POST attacks on web server capacity by calculating connection duration. It establishes that maximizing attack duration requires both exceeding server capacity and extending hold-up time.

Common mistake: Learners often select options B or C because the server can handle all incoming connections (m > a), failing to recognize that these scenarios do not result in unavailability. Others might overlook the duration calculation for option A versus D.

Expert Analysis

Why the Answer Is Correct

The correct answer is A because it satisfies two critical conditions for a successful denial-of-service: overload and persistence. First, the number of attacker connections (a=100) exceeds the server's management capacity (m=90), creating a bottleneck. Second, the hold-up time per connection (b=15 seconds) is the highest among all valid overload scenarios. The total attack duration D is calculated as a b, which equals 100 15 = 1500 seconds. This is the maximum possible duration among the options that actually overwhelm the server.

Why the Other Options Are Wrong

Options B (m=105) and C (m=110) are incorrect because the server capacity (m) exceeds the attacker's connection count (a=100). In these cases, the server can manage all requests without being overwhelmed, so no significant unavailability occurs regardless of the hold-up time. Option D (m=95, b=10) does overwhelm the server since m < a, but the resulting duration is only 100 * 10 = 1000 seconds. Since 1000 seconds is less than 1500 seconds, it results in a shorter period of unavailability compared to Option A.

Community Comment Notes

Community consensus strongly favors Option A, with most users correctly identifying that the server must be overloaded (m < a) and the duration maximized. As user insaniunt noted, "Because the attacker sends more connections than the server can handle, and each connection lasts for the longest time..." User shubhi6 reinforced this by excluding B and C due to sufficient capacity and comparing the durations of A and D. Some confusion existed regarding the formula, but the majority correctly applied D = a * b.

Exam Strategy

When analyzing DoS scenarios involving variables, always check if the attack volume exceeds system capacity first; if the system isn't overwhelmed, the attack fails. Then, compare the duration metrics of the remaining overwhelming scenarios to find the maximum impact.

Frequently Asked Questions

Why are options B and C incorrect even though they have high hold-up times?

Options B and C are incorrect because the server capacity (m=105 and m=110) exceeds the attacker's connections (100). The server handles all requests successfully, preventing any denial of service.

How is the attack duration calculated in this question?

The question defines duration D as the product of the number of connections (a) and the hold-up time per connection (b). Thus, D = a b. For option A, 100 15 = 1500 seconds.

More 312-50v12 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. LordXander 👍 3 Answered A
    Guys...it's A...I know people used AI for this question however, upon further questioning about the math is literally highlighted that A is the correct answer (checked from multiple sources). In question regarding tools/numbers, ask for details about each option and you will see yourself the correct answer
  2. insaniunt 👍 3 Answered A
    I think: A. Because the attacker sends more connections than the server can handle, and each connection lasts for the longest time among the options. The attack duration is D = 100 * 15 = 1500 seconds, which is the highest possible value.
  3. [Removed] 👍 2
    Could someone please validate this information
  4. blehbleh 👍 1 Answered A
    This A and I am not understanding what other people are not understanding of how to solve this question. The question at the end wants to know which one will result in the most down time or something along those lines I cant view it with this discussion pulled up. Regardless option A the attacks are longer or more then what the server can manage that is easily viewable and the attacks are 15 seconds in duration, so with the server not being able to handle all the requests and the 15 seconds it makes it the longest duration attack. I think most of the other options the server can manage the requests because the requests are less of that then which the server can handle. Just because a time is larger does not mean the server could not handle the amount of requests.
  5. shubhi6 👍 1 Answered A
    B & C can be exclude right away as the value of "m" is greater than "a" so can easily manage those request. Now coming to option D which has m = 95 if we calculate the duration it would 100 10 = 1000 also logically it would hold for less time as compared to the value m=90 for this also duration would be 15 100 = 1500, hence Answer is A. Hope it make sense.
Show 4 more comments
  1. Unr34l 👍 1
    A You need to analice the variable m, if m is lower than the connections of the attacker, it overload
  2. anarchyeagle 👍 1 Answered C
    Chatgpt answer: a=1500 seconds b=1200 seconds c=2000 seconds d=1000 seconds
  3. [Removed] 👍 1
    Could anyone verify the correctness of this answer
  4. agelbahri 👍 1 Answered A
    M<A and time: 100*15=1500

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide