Slow HTTP POST Attack Duration Calculation
An audacious attacker is targeting a web server you oversee. He intends to perform a Slow HTTP POST attack, by manipulating 'a' HTTP connection. Each connection sends a byte of data every 'b' second, effectively holding up the connections for an extended period. Your server is designed to manage 'm' connections per second, but any connections exceeding this number tend to overwhelm the system. Given 'a=100' and variable 'm', along with the attacker's intention of maximizing the attack duration 'D=a*b', consider the following scenarios. Which is most likely to result in the longest duration of server unavailability?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The core test is identifying the scenario where the number of attacker connections exceeds the server's limit (m < a) while simultaneously maximizing the product of connections and time per connection (D = a * b).
This question evaluates the impact of Slow HTTP POST attacks on web server capacity by calculating connection duration. It establishes that maximizing attack duration requires both exceeding server capacity and extending hold-up time.
Learners often select options B or C because the server can handle all incoming connections (m > a), failing to recognize that these scenarios do not result in unavailability. Others might overlook the duration calculation for option A versus D.
Community Discussion (9 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is A because it satisfies two critical conditions for a successful denial-of-service: overload and persistence. First, the number of attacker connections (a=100) exceeds the server's management capacity (m=90), creating a bottleneck. Second, the hold-up time per connection (b=15 seconds) is the highest among all valid overload scenarios. The total attack duration D is calculated as a b, which equals 100 15 = 1500 seconds. This is the maximum possible duration among the options that actually overwhelm the server.Why the Other Options Are Wrong
Options B (m=105) and C (m=110) are incorrect because the server capacity (m) exceeds the attacker's connection count (a=100). In these cases, the server can manage all requests without being overwhelmed, so no significant unavailability occurs regardless of the hold-up time. Option D (m=95, b=10) does overwhelm the server since m < a, but the resulting duration is only 100 * 10 = 1000 seconds. Since 1000 seconds is less than 1500 seconds, it results in a shorter period of unavailability compared to Option A.Community Comment Notes
Community consensus strongly favors Option A, with most users correctly identifying that the server must be overloaded (m < a) and the duration maximized. As user insaniunt noted, "Because the attacker sends more connections than the server can handle, and each connection lasts for the longest time..." User shubhi6 reinforced this by excluding B and C due to sufficient capacity and comparing the durations of A and D. Some confusion existed regarding the formula, but the majority correctly applied D = a * b.Exam Strategy
When analyzing DoS scenarios involving variables, always check if the attack volume exceeds system capacity first; if the system isn't overwhelmed, the attack fails. Then, compare the duration metrics of the remaining overwhelming scenarios to find the maximum impact.
Frequently Asked Questions
Why are options B and C incorrect even though they have high hold-up times?
Options B and C are incorrect because the server capacity (m=105 and m=110) exceeds the attacker's connections (100). The server handles all requests successfully, preventing any denial of service.
How is the attack duration calculated in this question?
The question defines duration D as the product of the number of connections (a) and the hold-up time per connection (b). Thus, D = a b. For option A, 100 15 = 1500 seconds.