What Causes Server Outage When Servers Are Online but Unresponsive?
Short answer
A Denial of service
Question
Key Takeaways
The exam tests your ability to correlate monitoring data (e.g., high received traffic) with network attack symptoms. The trap is to confuse network-level attacks like ARP poisoning or jamming with a server-level resource exhaustion attack.
This SY0-701 question asks about a server outage where devices remain online but inaccessible, with monitoring data showing excessive traffic. The community consensus is that a denial-of-service (DoS) attack is the most likely cause, as it overwhelms servers with traffic.
Common mistake: ARP poisoning or jamming are common distractors because they also cause connectivity issues, but the monitoring data showing excessive traffic to the servers points specifically to a denial-of-service (DoS) condition, not a network mapping or radio frequency attack.
Expert Analysis
Why the Answer Is Correct
A denial of service (DoS) attack occurs when an attacker floods a target server with excessive traffic, exhausting its resources (CPU, memory, bandwidth) and making it unable to respond to legitimate requests. The monitoring system likely shows a spike in incoming traffic and high resource utilization on the test servers, while the servers themselves remain powered on and reachable at the network level. This exactly matches the scenario of servers being "online but unresponsive."
Why the Other Options Are Wrong
ARP poisoning is a layer-2 attack that manipulates ARP tables to redirect traffic, but it would cause connectivity issues between devices rather than overwhelming a server's resources. Jamming is a wireless denial-of-service technique that disrupts radio frequencies, not applicable to wired server networks. Kerberoasting is an attack against Active Directory Kerberos tickets to crack service account passwords, unrelated to server outage or traffic volume.
Community Comment Notes
The top comment (11 likes) explicitly states, "This is clearly indicative of DoS attack where the two Test hosts are being overwhelmed with excessive traffic received causing them to become unresponsive and crash." Another commenter notes that Kerberoasting is not in the exam objectives, reinforcing that A is the correct answer. A third comment simply states "DDOS attack, check the traffic received on the servers," highlighting the importance of reviewing the monitoring graph for traffic abnormalities.
Official Reference
- https://www.comptia.org/certifications/security
- https://datatracker.ietf.org/doc/html/rfc4732
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
These links open the official vendor documentation in a new tab.
Exam Strategy
When analyzing monitoring data in Security+ questions, first look for abnormal network traffic or resource usage metrics. If servers remain online but experience high inbound traffic, associate this with a denial-of-service attack, and eliminate options that affect network paths rather than server resources.
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
a4e15bd 👍 11A Denial of Service. This is clearly indicative of DoS attack where the two Test hosts are being overwhelmed with excessive traffic received causing them to become unresponsive and crash.
-
TrebleSmith 👍 6 Answered AI do not see Kerberoasting anywhere in the exam objectives, leading me to believe the answer is A: DoS
-
Justhereforcomptia 👍 3 Answered ADDOS attack, check the traffic received on the servers
-
Muhammad_Umair 👍 1A). DDOS attack.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →