Cisco Certified Internetwork Expert (CCIE) Practice Test

Which statements are accurate regarding ping flood attacks? (Choose two)

1. They attack by sending ping requests to the return address

2. They utilize ICMP packets

3. They send requests to the broadcast address of the network

4. They use UDP packets

The correct answer is: They utilize ICMP packets

A ping flood attack is a type of denial-of-service (DoS) attack where the attacker overwhelms a target with ICMP echo request packets (commonly known as "ping" requests). The statement regarding the utilization of ICMP packets is accurate; these are the protocol used for the ping commands. ICMP (Internet Control Message Protocol) is essential in this context because ping uses it to request responses from network devices, and attackers exploit this by sending a plethora of such requests, which can congest the network and potentially lead to service disruption for legitimate users. The nature of the attack often involves overwhelming a network interface's capacity, which can lead to packet loss and failures in legitimate requests. The other choices lack specificity or reflect incorrect methodologies used in typical ping flood attacks. For example, a ping flood would not specifically involve sending requests to a broadcast address as a common practice; while some flooding attacks may exploit broadcast addresses, a standard ping flood targets a specific host. Similarly, a ping flood does not use UDP packets, as it relies entirely on ICMP for sending and receiving the ping requests and replies.