What Attack Is Indicated by Multiple Simultaneous SYN Requests on Port 443?
A systems administrator is advised that an external web server is not functioning property. The administrator reviews the following firewall logs containing traffic going to the web server: Which of the following attacks is likely occurring? - 
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests your ability to correlate firewall log timestamps and source IP diversity with specific attack signatures, while the common trap is misidentifying volumetric connection floods as authentication-based or application-layer exploits.
This SY0-701 question tests your ability to identify network attacks through firewall log pattern analysis. The community consensus confirms that a high volume of concurrent SYN packets from diverse source IPs targeting a single service is the definitive signature of a Distributed Denial of Service (DDoS) attack.
Brute-force is frequently chosen incorrectly because it also involves repeated traffic, but it generates failed login attempts on management ports rather than massive, simultaneous TCP handshake initiations on HTTPS.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The firewall logs display numerous SYN packets arriving at nearly identical timestamps from various source IP addresses, all targeting port 443. This pattern is the textbook signature of a SYN flood, a classic DDoS technique where attackers exhaust a server’s TCP connection table by never completing the three-way handshake. Because the requests originate from multiple distributed sources simultaneously, they overwhelm the web server’s resources, causing it to stop responding. Recognizing this synchronized, high-volume handshake initiation is key to identifying a DDoS event.Why the Other Options Are Wrong
Directory traversal attacks exploit vulnerable file paths to access restricted directories and would appear as HTTP GET/POST requests with encoded path sequences, not raw TCP SYN floods. Brute-force attacks focus on repeatedly guessing credentials, which generates failed authentication logs on management or mail ports rather than mass connection requests on HTTPS. An HTTPS downgrade involves manipulating TLS negotiation to force weaker encryption, leaving traces in certificate or cipher suite mismatches, not in overwhelming SYN packet volumes.Community Comment Notes
Multiple users correctly identified the attack by noting the simultaneous timestamps and diverse source IPs, explicitly linking them to SYN flood mechanics. Commenters highlighted that all of those SYN messages prove this is a DDos attack and emphasized the coordinated nature visible in the log timestamps. Several notes reinforced that port 443 combined with rapid handshake initiation is a definitive indicator of volumetric DDoS rather than application-layer exploits.Official Reference
Exam Strategy
When analyzing firewall or IDS logs for exam questions, always prioritize timestamp clustering and source IP diversity over individual packet details. Memorize the distinct traffic patterns of common attacks: SYN floods show rapid handshake initiations, brute-force shows repeated auth failures, and directory traversal shows suspicious URI encoding. Practice correlating log snippets with attack phases to quickly eliminate distractors.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →