What Attack Is Indicated by Multiple Simultaneous SYN Requests on Port 443?

SY0-701 By islever Editorial Last updated

Short answer

A DDoS

Question

A systems administrator is advised that an external web server is not functioning property. The administrator reviews the following firewall logs containing traffic going to the web server: Which of the following attacks is likely occurring? - Exhibit: What Attack Is Indicated by Multiple Simultaneous SYN Requests on
  1. DDoS Correct Answer
  2. Directory traversal
  3. Brute-force
  4. HTTPS downgrade

Key Takeaways

Tests your ability to correlate firewall log timestamps and source IP diversity with specific attack signatures, while the common trap is misidentifying volumetric connection floods as authentication-based or application-layer exploits.

This SY0-701 question tests your ability to identify network attacks through firewall log pattern analysis. The community consensus confirms that a high volume of concurrent SYN packets from diverse source IPs targeting a single service is the definitive signature of a Distributed Denial of Service (DDoS) attack.

Common mistake: Brute-force is frequently chosen incorrectly because it also involves repeated traffic, but it generates failed login attempts on management ports rather than massive, simultaneous TCP handshake initiations on HTTPS.

Expert Analysis

Why the Answer Is Correct

The firewall logs display numerous SYN packets arriving at nearly identical timestamps from various source IP addresses, all targeting port 443. This pattern is the textbook signature of a SYN flood, a classic DDoS technique where attackers exhaust a server’s TCP connection table by never completing the three-way handshake. Because the requests originate from multiple distributed sources simultaneously, they overwhelm the web server’s resources, causing it to stop responding. Recognizing this synchronized, high-volume handshake initiation is key to identifying a DDoS event.

Why the Other Options Are Wrong

Directory traversal attacks exploit vulnerable file paths to access restricted directories and would appear as HTTP GET/POST requests with encoded path sequences, not raw TCP SYN floods. Brute-force attacks focus on repeatedly guessing credentials, which generates failed authentication logs on management or mail ports rather than mass connection requests on HTTPS. An HTTPS downgrade involves manipulating TLS negotiation to force weaker encryption, leaving traces in certificate or cipher suite mismatches, not in overwhelming SYN packet volumes.

Community Comment Notes

Multiple users correctly identified the attack by noting the simultaneous timestamps and diverse source IPs, explicitly linking them to SYN flood mechanics. Commenters highlighted that all of those SYN messages prove this is a DDos attack and emphasized the coordinated nature visible in the log timestamps. Several notes reinforced that port 443 combined with rapid handshake initiation is a definitive indicator of volumetric DDoS rather than application-layer exploits.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When analyzing firewall or IDS logs for exam questions, always prioritize timestamp clustering and source IP diversity over individual packet details. Memorize the distinct traffic patterns of common attacks: SYN floods show rapid handshake initiations, brute-force shows repeated auth failures, and directory traversal shows suspicious URI encoding. Practice correlating log snippets with attack phases to quickly eliminate distractors.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. dbrowndiver 👍 6 Answered A
    (100.50.20.7) on port 443. This pattern is typical of a SYN flood DDoS attack, where attackers overwhelm a server with SYN requests to deplete its resources. Simultaneous Connections: All requests occur simultaneously (01:45:09.102), suggesting a coordinated attack, which is a hallmark of DDoS attacks. DDoS is the correct answer because the logs display multiple SYN requests from different IP addresses to the same server in a short time, indicative of a SYN flood DDoS attack aimed at overwhelming the server and causing disruption.
  2. ezmoney 👍 3
    all of those SYN messages prove this is a DDos attack.
  3. MAKOhunter33333333 👍 5 Answered A
    DDOS via syn attack
  4. Shaman73 👍 2 Answered A
    A. DDoS

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide