What Causes Server Outage When Servers Are Online but Unresponsive?
A systems administrator notices that a testing system is down. While investigating, the systems administrator finds that the servers are online and accessible from any device on the server network. The administrator reviews the following information from the monitoring system: Which of the following is the most likely cause of the outage? - 
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests your ability to correlate monitoring data (e.g., high received traffic) with network attack symptoms. The trap is to confuse network-level attacks like ARP poisoning or jamming with a server-level resource exhaustion attack.
This SY0-701 question asks about a server outage where devices remain online but inaccessible, with monitoring data showing excessive traffic. The community consensus is that a denial-of-service (DoS) attack is the most likely cause, as it overwhelms servers with traffic.
ARP poisoning or jamming are common distractors because they also cause connectivity issues, but the monitoring data showing excessive traffic to the servers points specifically to a denial-of-service (DoS) condition, not a network mapping or radio frequency attack.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A denial of service (DoS) attack occurs when an attacker floods a target server with excessive traffic, exhausting its resources (CPU, memory, bandwidth) and making it unable to respond to legitimate requests. The monitoring system likely shows a spike in incoming traffic and high resource utilization on the test servers, while the servers themselves remain powered on and reachable at the network level. This exactly matches the scenario of servers being "online but unresponsive."
Why the Other Options Are Wrong
ARP poisoning is a layer-2 attack that manipulates ARP tables to redirect traffic, but it would cause connectivity issues between devices rather than overwhelming a server's resources. Jamming is a wireless denial-of-service technique that disrupts radio frequencies, not applicable to wired server networks. Kerberoasting is an attack against Active Directory Kerberos tickets to crack service account passwords, unrelated to server outage or traffic volume.
Community Comment Notes
The top comment (11 likes) explicitly states, "This is clearly indicative of DoS attack where the two Test hosts are being overwhelmed with excessive traffic received causing them to become unresponsive and crash." Another commenter notes that Kerberoasting is not in the exam objectives, reinforcing that A is the correct answer. A third comment simply states "DDOS attack, check the traffic received on the servers," highlighting the importance of reviewing the monitoring graph for traffic abnormalities.
Official Reference
Exam Strategy
When analyzing monitoring data in Security+ questions, first look for abnormal network traffic or resource usage metrics. If servers remain online but experience high inbound traffic, associate this with a denial-of-service attack, and eliminate options that affect network paths rather than server resources.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →