Which Attack Do Mirai IoT Botnets Launch?
Mirai malware targets IoT devices. After infiltration, it uses them to propagate and create botnets that are then used to launch which types of attack?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the end goal of a Mirai-built IoT botnet; the trap is confusing the propagation method with the attack the botnet executes, leading learners toward MITM or password attacks.
Mirai malware infects Internet of Things devices such as cameras and routers, enslaving them into a botnet that floods targets with traffic. This question establishes that the botnet's purpose is launching distributed denial-of-service (DDoS) attacks, making option D correct.
Option A (MITM attack) is the most tempting distractor because sniffing and interception are associated with compromised devices, but Mirai's weaponized botnet is designed for traffic flooding, not traffic interception.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Mirai scans for IoT devices with default or weak credentials, compromises them, and aggregates them into a botnet under a command-and-control server. The defining purpose of such a botnet, as documented in the CEH v12 malware chapter, is to coordinate thousands of enslaved devices to flood a victim simultaneously. That coordinated multi-source flooding is by definition a distributed denial-of-service (DDoS) attack, so option D is correct. The 2016 Mirai attacks on Dyn DNS infrastructure, which overwhelmed targets with tens of millions of IoT-originated requests, are the canonical example. Community voting was unanimous for D, and that consensus matches the malware's documented behavior.Why the Other Options Are Wrong
Option A, MITM attack, requires intercepting and altering communications between two parties; a Mirai botnet does not position itself in the traffic path of a target, it floods the target. Option B, password attack, is a technique Mirai uses during its scanning phase to gain initial access, but it is not what the assembled botnet is deployed to launch. Option C, birthday attack, is a cryptographic collision technique targeting hash functions and has no relationship to IoT botnet operations. None of these three describe the large-scale volumetric traffic generation that a Mirai botnet is built for.Community Comment Notes
LordXander summarized the doctrine plainly, noting that "Botnets are usually used for DDoS attacks." kenjeshry cited the CEHv-12 module text describing devices "enslaving the targeted device into the attacker's mobile botnet" to perform activities including "launching DDoS attacks and web injections." nosavotor asked the team to double-check the response, and insaniunt confirmed simply "D. DDoS attack" — the collective verification supports our independent verdict.Exam Strategy
Read the question's end goal: it asks what the botnet is used to launch, not how Mirai infects devices. Treat credential-gathering and scanning steps as means, and reserve your answer for the attack the enslaved devices collectively execute.
Frequently Asked Questions
Why is a MITM attack wrong when Mirai has compromised the device?
Mirai enslaves devices to flood a target with traffic from many sources; it does not place itself between a victim and a destination to intercept or alter communications, which is what MITM requires.
Isn't a password attack what Mirai does to IoT devices?
Mirai uses default and weak credential guessing only to gain initial entry during scanning. The question asks what the resulting botnet launches afterward, which is a DDoS attack.